.product-purple li { color: #ffff; } p#ipp-innertext { color: #fff; }
Eliminate the delays of VPN bottlenecks and manual, offline collections by acquiring data from any remote device without ever requiring physical access. With Exterro FTK Enterprise, execute rapid, targeted evidence acquisitions, accelerating your investigations while keeping business operations running smoothly.


With Exterro FTK Enterprise, execute rapid, targeted data collections from any remote device across your enterprise without disrupting business operations. Once the data is secure, immediately analyze that evidence to quickly expose data breaches, intellectual property theft, file tampering, and malicious insider activity.
.jpg)
From multiple locations to massive employee pools and remote workers, this hospital system needed to access their entire network of endpoints to identify potential threats and eliminate them before they became full-blown incidents.

Exterro Intelligence powers FTK Enterprise to streamline the critical path from remote data collection, through complex analysis, straight to the final decision. By utilizing AI to prioritize the most important data, FTK Enterprise maximizes your team's productivity and accelerates time to insight.

FTK Enterprise enables discreet, agent-based remote collection into a secure forensic container across your entire distributed environment. Without ever needing physical access, you can seamlessly collect critical evidence from laptops, desktops, and remote employees to keep your investigations moving forward.

Streamline your investigations by acquiring only the critical evidence you need. By reducing unnecessary data volumes, you accelerate your analysis phase while strictly preserving the forensic integrity required to defend your findings.

Eliminate redeployment delays with a persistent endpoint agent. Maintain constant readiness and empower your team to launch targeted collections and respond to incidents the exact moment they occur.

Capture critical data from laptops and systems that aren't always connected. Our resilient architecture continues working when devices go offline and automatically resumes the exact moment they reconnect, ensuring no evidence slips through the cracks.
.png)
Exterro's ironclad commitment to securing data has earned us ISO 27001, SOC II, FedRAMP, TISAX, and HiTrust certifications.
Lorem ipsum dolor sit amet, consectetur adipiscing elit. Suspendisse varius enim in eros elementum tristique. Duis cursus, mi quis viverra ornare, eros dolor interdum nulla, ut commodo diam libero vitae erat.
“This system reduces the burden of the staff in the FOIA Request Service Center during the collection, review and preparation of documents and materials in response to FOIA requests.”

With 190+ native connectors to enterprise data sources across email, cloud storage, mobile devices, and collaboration platforms, Exterro delivers secure, direct and deeper access to more enterprise data sources than any other solution.
FTK Enterprise has the ability to perform full-disk data collection (Windows, Mac, Linux) from both on-network and off-network endpoints, as well as from network shares and cloud data sources like Gmail, Google Drive, One Drive, O365, Microsoft Teams, SharePoint, and Exchange, and more.
Yes, FTK Enterprise uses a persistent agent that can be mass deployed to thousands of endpoints at once, including on Macs by using Jamf®. Our Agent gains full access to the disk, including all volumes and files. The FTK Agent runs as a service, and ensures a secure connection by using your organization’s X.509 certificate to protect the endpoint from becoming vulnerable. The service running does not cause the endpoint to lag and should be undetectable to the user while they’re working. The agent collects into forensically-sound evidence file formats, such as AD1, E01, L01, DMG, etc.
Yes, the agent can be installed and remain inactive until called upon, or you can deploy an agent for a specific preview or collection activity, and then uninstall it.
As described above, you will first deploy the remote agent to a Windows, Linux or Mac endpoint. You will then configure a site server to manage collection activity initiated by these remote agents located outside the local network. When you initiate a collection job from FTK Enterprise, the site server receives the request and communicates with the remote agent on the endpoint. When the endpoint is online and a connection is established, the endpoint data is encrypted and collected into an AD1 file, and then retrieved through the firewall where it can then be reviewed and analyzed in FTK Enterprise. NOTE: for off-network (i.e., off-VPN) acquisition, secure public site servers can be configured in place of private servers.
FTK Enterprise remote agents can provide visibility into endpoint data including geolocation, internet, file, and program history including uploads, downloads, and deletions. Here are some examples of what you can investigate:
- Windows Registry + System Information
- Volatile Data / Memory Analysis
- Browser history & activity
- File uploads and downloads
- Files emailed within the company or to external recipients
- Recently accessed programs, files, and network shares
- External devices that were connected to a computer
- Origination of “phishing scams” or malware
- User location based on connected network
If the endpoint goes offline during a remote collection, the collection will be paused and will automatically resume once the endpoint comes back online. If the disconnection happens during a Live Preview session, specifically, a ‘snapshot’ is created so the FTK Enterprise admin can continue to sift through file structure. The contents of the files might not be available, but the structure is there. When they find what they are looking for, the admin can send another job to the site server asking it to perform a collection when the endpoint comes back online again.

Lorem ipsum dolor sit amet, consectetur adipiscing elit. Suspendisse varius enim in eros elementum tristique.
Learn about the best practices and technology that can help your organization improve its investigatory workflows.

Learn how you can conduct internal investigations and facilitate legal and regulatory compliance in enterprise environments with FTK Enterprise.

Download this product brief to learn how Exterro can transform the way you preview, collect, and analyze remote mobile device data.

Transform mobile investigations with Exterro Remote Mobile Discovery. No agents, no cables—just seamless, secure data collection. Learn more or book a demo today!
See our digital forensics and cybersecurity investigation solutions in action.