Skip to content
A person typing on a laptop

FTK Forensic Toolkit

The gold standard in digital forensics software for repeatable, defensible full-disk image collection, processing and review

Exterro FTK is trusted by public and private sector organizations worldwide

U.S. Department of Justice logo California department of justice logo Ford Logo Booze Allen Hamilton Logo Raytheon technologies logo

Streamline forensic investigations to locate key evidence and solve complex cases faster.

A person is holding a magnifying glass over a laptop screen A person is holding a magnifying glass over a laptop screen

Seconds matter in critical investigations.  FTK gives investigators a head start by pointing them directly to the artifacts that matter most, narrowing down the scope of their investigation, and reducing the time it takes to close cases.

  • Be Instantly Productive

    FTK’s intuitive interface design makes it easier for both experienced investigators and non-technical users to navigate within the software, dramatically reducing the learning curve for all skill levels.

  • Find More Artifacts

    Eliminate the hours spent manually digging for the data types you’re interested in.  FTK intelligently categorizes and displays the most data artifacts to help you pinpoint key evidence faster.

  • Search Evidence Faster

    Since evidence is processed and indexed up front, you don’t have to wait for index searches to execute during your review. Filter and search evidence faster and more consistently than in any other solution.

An image of a fingerprint on a screen

Quickly locate, collect, and analyze digital evidence with the most trusted solution in the industry.

FTK’s reliable, scalable processing engine gets more evidence into the hands of examiners in less time, allowing them to dig deeper into their data and solve cases faster.  With its ability to create custom Python scripts, decrypt files, recover and crack passwords, parse registry files, and carve data to recover deleted evidence, FTK finds the data that other tools can’t. 

A person's hand is touching a phone with a glowing light on it

Investigate mobile device evidence and review chat app data with Mobile Data Processing.

Leverage FTK’s powerful processing engine to parse computer and mobile data in a single database to find connections across data sources.  FTK supports native unprocessed UFD extractions from mobile devices provided by tools like Cellebrite, Oxygen, XRY or GrayKey.  Review chat messages from apps like Twitter and WhatsApp, reconstructed in their near-native view to quickly interpret the conversation.

A woman wearing glasses is looking at a computer screen

Effortlessly pivot through image and video case evidence with Multimedia Thumbnail Review.

Hover over and click on thumbnails to easily inspect pictures of interest, then label and categorize images easily with keyboard shortcuts. FTK provides context for every image by reconstructing the device user’s activity leading up to and following the creation of the image via built-in mini timelines.  FTK’s investigator wellness settings reduce repeated exposure to sensitive content, such as in CSAM cases.

Want to try FTK for free for 30 days?

Download a free full-featured trial version of FTK to use with your own data sets.

Additional Capabilities

  • Mac Data Review

    Collect, process and analyze datasets containing Apple file systems that are encrypted, compressed or deleted. Parse and render Apple Mail, iMessage, iWork files, Safari browser data, Outlook for Mac email, Mac Artifacts, and Mac system summary data like Spotlight Search, KnowledgeC, and Power Log data. 

  • Image Identification and Categorization

    Use facial and object recognition to automatically locate images containing that same content. Help identify victims faster in CSAM investigations by analyzing and grading images and videos, then  comparing them with collaborative hash databases like Project Vic and CAID UK.

  • System Summary Parsing

    As Windows captures the timeline of actions of the user, FTK will parse those registry files for you. See every application the user opened, internet activity performed, networks the user was connected to, and where and when this activity occurred.

  • Portable Case

    Export your data into a portable case for offline review by a detective, analyst, attorney or outside reviewer. Any labels and bookmarks created by the reviewers are synced back to the original case.

"FTK is the only tool you need to process and parse ALL of your digital evidence – mobile data, computer data, and cloud app data.  The speed of the FTK processing engine can benefit both individual investigators and forensic lab teams, allowing them to uncover evidence twice as fast."

Wayne Mitchell Former FBI Senior Forensic Examiner, and current VP of Cyber Risk at Kroll

The Industry’s Most Innovative Organizations Partner with Exterro

From technology companies to organizations fighting child exploitation, Exterro’s partners make a difference for digital forensic investigators.

Semantics 21 Logo
CAID Logo
Project VIC International Logo
Grayshift Logo
RWS Logo

Frequently asked questions

  • What types of digital devices can FTK collect from?

    Create full-disk forensic images and process a wide range of data types from many sources, including Windows and Linux hard drives, CD’s and DVDs, thumb drives or other USB devices, network data and Internet storage, all in a centralized, secure database.

  • Can FTK collect directly from mobile devices?

    While FTK cannot extract data from mobile devices, FTK can ingest, process, and parse the native .UFD mobile extractions provided from Cellebrite (both .UFD and .UFDR), GrayKey, XRY, and Oxygen.  With the fastest scalable processing engine on the market, FTK can cut through mobile evidence up to 15 times faster than other tools, helping you speed through review and analysis, and even find common connections across data sources.

  • What sort of decryption capabilities does FTK have?

    Use FTK to decrypt a computer drive encrypted by the latest version of McAfee Drive Encryption, as well as a BitLocker-encrypted Windows device.  FTK can decrypt a device in a locked, unlocked, or disabled BitLocker state, and on-the-fly, without having to create a fully decrypted image first. Even with computers in a “Disabled–Protectors Suspended” BitLocker state (often shipped this way by default from hardware vendors), FTK can detect the suspended encryption, and automatically attempt to recover a clear key from the master boot record and decrypt the drive, all without the computer user’s input.

  • Can FTK image a remote endpoint over a network?

    FTK standalone cannot, but FTK Enterprise and FTK Central offer remote endpoint collection with their remote agent technology.

  • Do I really need FTK when I can use the free FTK Imager tool instead?

    While FTK Imager excels at electronic device imaging, its analysis and review capabilities are limited. Count on the full-featured FTK Forensic Toolkit to complete your workflow.  Read this overview of the 10 core forensic analysis and review tasks you’re going to want to perform in FTK.

  • What hash functions are available in FTK?

    When a full drive is imaged, a hash generated by FTK can be used to verify that the image and the original drive are identical and that the image has remained unchanged since acquisition. You can use either of the two leading hash functions available in FTK Imager: Message Digest 5 (MD5) and Secure Hash Algorithm (SHA-1).

Resources

Learn how Exterro FTK can power your forensic investigations.

White Papers

The Future of Digital Forensics

Download this guide to learn about developments in digital forensics that can help law enforcement investigators solve crimes faster and more easily.

Product Briefs

Exterro FTK® Suite Product Brief

Find out about the features that make the FTK Suite of digital forensics solutions the industry leader for corporate and public sector investigations.

White Papers

Top 10 Most Underrated FTK Features

FTK digital forensic software is feature-rich to enable forensic investigators to collaborate effectively, reduce backlog and automate collections and processing.

Ready to get started?

Accelerate Your Forensic Investigations with Exterro FTK

REQUEST A DEMO