.product-purple li { color: #ffff; } p#ipp-innertext { color: #fff; }
FTK Connect can automate key collection and analysis tasks, so investigators spend less time on manual processes and more time developing defensible findings.


FTK Connect enables corporations and law enforcement agencies to easily automate and accelerate key processes and tasks within DFIR investigations. With its dramatically simplified drag and drop interface, FTK Connect empowers users of all skill levels to save time by simplifying their workflows.
Lorem ipsum dolor sit amet, consectetur adipiscing elit. Suspendisse varius enim in eros elementum tristique. Duis cursus, mi quis viverra ornare, eros dolor interdum nulla, ut commodo diam libero vitae erat.
“This system reduces the burden of the staff in the FOIA Request Service Center during the collection, review and preparation of documents and materials in response to FOIA requests.”
“This system reduces the burden of the staff in the FOIA Request Service Center during the collection, review and preparation of documents and materials in response to FOIA requests.”

Let FTK Connect handle the mundane tasks, saving investigators’ time for what they do best: forensic analysis and review. Automate tasks like case creation and evidence processing, as well as next steps like searching and labeling results, exporting data, and more – all without any user interaction.
For full details on compatibility, visit our FAQ section.

Orchestrate your incident response workflow by integrating with your cybersecurity tools. Instantly collect and preserve electronic evidence upon detection of an intrusion. FTK Connect can automate collection from remote endpoints based on triggers from solutions like Palo Alto Networks Cortex XSOAR.

Reduce processing bottlenecks by automating case creation and evidence handling. FTK Connect can monitor designated folders, automatically ingest and process forensic images, run predefined searches, apply labels, and prepare results so examiners can begin analysis sooner.

Orchestrate FTK Connect with SIEM and SOAR platforms to investigate the root cause of a data breach and save precious time in the initial stages of incident response.
FTK Connect For Law Enforcement seamlessly integrates with the standalone version of the FTK Forensic Toolkit. You can purchase it here.
For FTK Lab, FTK Enterprise, and FTK Central customers, the full-featured version of FTK Connect includes additional automation workflows for incident response and internal investigations, plus the ability to integrate with other third-party platforms.
FTK Connect can automate case creation, evidence processing, keyword searching, tagging, and exporting. The full-featured version of FTK Connect, specifically, can also automate (remote) imaging and collection, either manually, scheduled, or triggered by a third party platform.
In addition to the drag-and-drop workflow interface, experienced programmers can also write custom Python scripts for the FTK Connect API. The API can integrate and connect FTK® products with cybersecurity platforms, case management systems, e-discovery applications, and other third-party software tools that have an ability to call a restful API.
For example, with the FTK Connect API configured, you can program FTK Enterprise or FTK Central to automatically run an endpoint collection or a memory and volatile data collection upon detection of a breach by the linked cybersecurity tool. This allows you to capture critical endpoint evidence immediately, before it’s deleted or modified, especially if the attack occurs in the off-hours and no one is at work to see or hear the cybersecurity tool alert.
You can collect either a full-disk image or volatile data from a remote endpoint with FTK Connect automation. For example, after an internal incident is detected, FTK Connect can use an automated playbook to trigger FTK Enterprise or FTK Central to initiate collection from the affected endpoint.
However, if you only collect a disk image after an incident has occurred, you may be unable to analyze information cached in memory, depending on the actions of the endpoint user. So by performing an automated memory dump, you can proceed with the investigation and recovery of saved passwords, open network connections, or recover an entire webpage, which may only be stored in memory, such as a page viewed in Chrome Incognito.
The benefit of automating a memory collection from a compromised endpoint is that the analysis can take place covertly, without alerting the suspected individual.
“This system reduces the burden of the staff in the FOIA Request Service Center during the collection, review and preparation of documents and materials in response to FOIA requests.”
See our automated forensic workflow solutions in action.