.product-purple li { color: #ffff; } p#ipp-innertext { color: #fff; }
Join the thousands of forensic professionals worldwide who rely on FTK Imager, the forensic industry’s preferred data imaging and preview solution, for the first step in investigating an electronic device.


FTK Imager is a free data preview and imaging tool used to acquire electronic evidence in a forensically sound manner by creating copies of computer data without making changes to the original evidence.

FTK Imager can create perfect copies (i.e., forensic images) of computer data without making changes to the original evidence. The forensic image is identical in every way to the original, including file slack and unallocated space or drive free space. Keep evidence safe from harm or tampering while the investigation proceeds using the image.

Mount an image for a read-only view that leverages Windows® File Explorer to see the content of the image exactly as the user saw it on the original drive. Recover files that have been deleted from the Recycle Bin, but have not yet been overwritten. Run virus scans or Python scripts on a mounted image to easily show a jury how a user would have seen their own files and folder structure.

Generate hash reports for regular files and disk images, including files inside disk images, that you can later use as a benchmark to prove the integrity of your case evidence. Hashes generated by FTK Imager can be used to verify that the image and the original drive are identical and that the image has remained unchanged since acquisition.


FTK Imager can preview and image Windows and Linux hard drives, CDs and DVDs, thumb drives or other USB devices.
No. You will need to use a mobile extraction tool like Cellebrite, GrayShift, XRY or Oxygen. Once you have the mobile extraction, the full-featured version of FTK can then ingest the native, unprocessed .UFD mobile extractions provided by these third-party tools.
Windows only. While Imager can image a Linux device, it cannot be installed on a Linux device.
FTK Imager uses either of the two leading hash functions: Message Digest 5 (MD5) and Secure Hash Algorithm (SHA-1).
Yes, FTK Imager can be run from a thumb drive or USB drive that is plugged into a live (powered on) device.
It truly depends on the capacity and size of the drive. The newest version of FTK Imager includes significant speed improvements in image creation—the time to image a device has been cut in half by optimizing the method we use to preserve the forensic image. The faster you preserve the data, the quicker analysis can begin.
Install FTK Imager for free today.

With FTK Imager Pro, you can:
Lorem ipsum dolor sit amet, consectetur adipiscing elit. Suspendisse varius enim in eros elementum tristique. Duis cursus, mi quis viverra ornare, eros dolor interdum nulla, ut commodo diam libero vitae erat.
Learn more about FTK Imager Pro and what it can deliver for you.
Learn how Exterro FTK Imager can power your forensic investigations.

Join the thousands of forensic professionals worldwide who trust FTK Imager as their go-to solution for the first step in investigating an electronic device.
While FTK Imager excels at electronic device imaging, its analysis and review capabilities are limited. Download this resource to learn what the full-featured FTK Forensic Toolkit can do for you that FTK Imager can't.

FTK digital forensic software is feature-rich to enable forensic investigators to collaborate effectively, reduce backlog and automate collections and processing.
Take the FTK Imager on-demand Training Course.