Quick answer: FTK (Forensic Toolkit) is Exterro's commercial forensic examination suite. The companion FTK Imager is free and is the tool most widely used in the field for acquisition, preview and RAM capture. The typical workflow is: attach a write blocker, acquire an E01 or raw image, run MD5 and SHA1 verification, index the image in FTK, run keyword and artifact analysis, then report the findings with chain of custody. If the verification hash does not match the source, the examination stops before it starts.

Tool choice in digital forensics is not a matter of taste. The question asked in court is this: how did you acquire the evidence, and how do you prove it has not changed. FTK is one of the toolsets designed to produce documented answers to both. This article explains what the FTK family is, how to acquire an image step by step with FTK Imager, why hash verification is not negotiable, and where FTK stands against Autopsy and EnCase.

What FTK is and how it differs from FTK Imager

The two products are frequently confused:

  • FTK Imager is free. Its job is acquisition: it creates physical or logical images, previews image content read only, exports files, captures memory (RAM) and computes hashes. It is small, portable and can be run from USB in the field.
  • FTK (Forensic Toolkit) is commercially licensed. Its job is analysis: it processes the acquired image, indexes all text with the dtSearch engine, parses mailboxes, carves deleted files, decodes registry and system artifacts, and uses the Known File Filter (KFF) to remove noise system files and reduce review load.

Product history matters too: FTK was known under the AccessData brand for many years, was acquired by Exterro in 2020, and is developed under Exterro today.

Which image format to choose

Format Description When to prefer
E01 Expert Witness Format. Compression, hash and case metadata embedded in the image Default choice. Integrity proof travels inside the file
Raw (dd) Plain bit for bit copy, no metadata When the broadest tool compatibility is required
AD1 AccessData logical image format When only selected folders or files are acquired
AFF4 Open standard, efficient at large volumes Modern workflows with supporting tools

Practical rule: unless something requires otherwise, choose E01. Because hash and case information travel inside the image, you still hold the integrity proof years later.

Acquiring an image with FTK Imager step by step

The following order is what produces a copy that will stand up in court.

  1. Attach the write blocker. Use a hardware write blocker. Connecting a suspect disk directly to the analysis machine lets the operating system write to it and corrupt timestamps.
  2. Identify the source. In Create Disk Image, select the physical drive. A physical image includes the partition table and unallocated space, a logical image does not.
  3. Choose format and destination. Select E01 and write to a wiped destination disk.
  4. Enter case information. Fill in case number, examiner, date and description. These are written into the E01 and become part of the chain of custody.
  5. Leave verification enabled. Keep "verify images after they are created" checked. FTK Imager hashes the source, writes the image, then reads the image back and recomputes the hash.
  6. Preserve the hash result. MD5 and SHA1 values are reported at the end. The source hash and the verification hash must be identical. If they differ the image is invalid and analysis must not begin until the cause is found.
  7. Archive the log. The .txt summary produced by Imager must be stored with the image.

Order matters when capturing RAM

Volatile data is collected first. If the device is powered on, capture RAM with FTK Imager's Capture Memory before shutting it down. Encryption keys, running malware and open network connections exist only in memory. The moment you power the device off, that evidence is gone.

Why hash verification is not negotiable

A hash is the mathematical fingerprint proving the evidence has not changed. Change a single bit and the output is completely different. Hashes are used at three points:

  • At acquisition, to prove source and image are identical.
  • During analysis, to confirm the working copy has not been corrupted.
  • At handover and in court, to show no interference occurred in the meantime.

MD5 and SHA1 are cryptographically weakened against collision attacks. This does not make them useless as integrity records in forensics, but current practice is to record SHA256 alongside them. Most tools can produce multiple hashes at once.

FTK, Autopsy and EnCase compared

Criterion FTK (Exterro) Autopsy (Sleuth Kit) EnCase (OpenText)
Licensing Commercial Open source, free Commercial
Acquisition FTK Imager is free External tools (Guymager, dd) Has its own imager
Indexing Strong full text via dtSearch Keyword and module based Strong, customizable with EnScript
Learning curve Moderate Low, ideal for training High
Extensibility Limited Python and Java modules, large community EnScript
Cost High None High

The right question is not "which is best" but which is defensible for this case. Organizations commonly use FTK Imager for acquisition and, depending on budget, FTK, Autopsy or EnCase for analysis. What matters is not the tool name but that the method is documented and reproducible. For the limits of using AI during an examination, see can ChatGPT be used in digital forensics.

Common mistakes

  • Skipping the write blocker. The most frequent and most expensive error. The operating system writes the moment the disk is attached and timestamps are corrupted.
  • Taking a logical image while assuming it is physical. A logical image excludes unallocated space, so recovery expectations fail.
  • Skipping verification. Verification is disabled to save time, and integrity can no longer be defended.
  • Working on the original disk. Analysis is always performed on a copy of the image.
  • Ignoring RAM. If memory is not captured while the device is on, encryption keys and running process data are lost permanently.
  • Not filing hash records. If hashes are not written in the report, the integrity claim is merely verbal.

Frequently asked questions

Is FTK Imager really free? Yes. FTK Imager is distributed free of charge and is widely used for acquisition, preview and memory capture. The FTK analysis suite is commercially licensed.

Is FTK Imager enough on its own? For small scope work, preview and file export may suffice. Keyword indexing, mailbox parsing and thorough carving require an analysis suite or a tool such as Autopsy.

Should I choose E01 or raw? E01 unless a compatibility requirement dictates otherwise, because hash and case information travel inside the image.

If MD5 is broken, why is it still used? Collision attacks make MD5 unsuitable for cryptographic signatures. It is still recorded as an integrity value in forensics, but it should be used together with SHA256 rather than alone.

What if the verification hash does not match? Do not proceed to analysis. Investigate read errors on the source media, cable or adapter faults and hardware failure, record the situation and repeat the acquisition.

Can an encrypted disk be imaged? It can be imaged, but the content stays encrypted. Decryption requires a key, a recovery password, or a memory capture taken while the device was unlocked. This is why capturing RAM on a running device is critical.

Sources

There is no margin for error in acquisition, hash verification and expert reporting. To discuss the right method for your case, contact DSET. From our Ankara Hacettepe Teknokent laboratory we run forensic imaging, analysis and reporting end to end.