.product-purple li { color: #ffff; } p#ipp-innertext { color: #fff; }
The gold standard in digital forensics software for repeatable, defensible full-disk image collection, processing and review.


Seconds matter in critical investigations. FTK gives investigators a head start by pointing them directly to the artifacts that matter most, narrowing down the scope of their investigation, and reducing the time it takes to close cases.

FTK’s scalable processing engine ingests and analyzes large evidence sets quickly, getting data into the hands of examiners sooner so they can focus on investigation rather than waiting on processing. Investigators can automate workflows with scripting, analyze system artifacts such as registry data, recover deleted files through data carving, and access encrypted content when proper credentials are available. The result is more complete analysis and faster case resolution.

Leverage FTK’s powerful processing engine to parse computer and mobile data in a single database to find connections across data sources. FTK supports native unprocessed UFD extractions from mobile devices provided by tools like Cellebrite, Oxygen, XRY or GrayKey. Review chat messages from apps like Twitter and WhatsApp, reconstructed in their near-native view to quickly interpret the conversation.

Hover over and click on thumbnails to easily inspect pictures of interest, then label and categorize images easily with keyboard shortcuts. FTK provides context for every image by reconstructing the device user’s activity leading up to and following the creation of the image via built-in mini timelines. FTK’s investigator wellness settings reduce repeated exposure to sensitive content, such as in CSAM cases.


From technology companies to organizations fighting child exploitation, Exterro’s partners make a difference for digital forensic investigators.
Everything you need to know about our platform in one place. features, pricing, integrations, and more, all answered for you.
Create full-disk forensic images and process a wide range of data types from many sources, including Windows and Linux hard drives, CD’s and DVDs, thumb drives or other USB devices, network data and Internet storage, all in a centralized, secure database.
The standalone version of FTK cannot image or collect from MacOS devices, but you can import Mac data collected by a third-party tool. Our FTK Enterprise solution is able to perform remote Mac collection, learn more here.
While FTK cannot extract data from mobile devices, FTK can ingest, process, and parse the native .UFD mobile extractions provided from Cellebrite (both .UFD and .UFDR), GrayKey, XRY, and Oxygen. With the fastest scalable processing engine on the market, FTK can cut through mobile evidence up to 15 times faster than other tools, helping you speed through review and analysis, and even find common connections across data sources.
Use FTK to decrypt a computer drive encrypted by the latest version of McAfee Drive Encryption, as well as a BitLocker-encrypted Windows device. FTK can decrypt a device in a locked, unlocked, or disabled BitLocker state, and on-the-fly, without having to create a fully decrypted image first. Even with computers in a “Disabled–Protectors Suspended” BitLocker state (often shipped this way by default from hardware vendors), FTK can detect the suspended encryption, and automatically attempt to recover a clear key from the master boot record and decrypt the drive, all without the computer user’s input.
FTK standalone cannot, but FTK Enterprise and FTK Central offer remote endpoint collection with their remote agent technology.
While FTK Imager excels at electronic device imaging, its analysis and review capabilities are limited. Count on the full-featured FTK Forensic Toolkit to complete your workflow. Read this overview of the 10 core forensic analysis and review tasks you’re going to want to perform in FTK.
When a full drive is imaged, a hash generated by FTK can be used to verify that the image and the original drive are identical and that the image has remained unchanged since acquisition. You can use either of the two leading hash functions available in FTK Imager: Message Digest 5 (MD5) and Secure Hash Algorithm (SHA-1).
Learn how Exterro FTK can power your forensic investigations.

FTK digital forensic software is feature-rich to enable forensic investigators to collaborate effectively, reduce backlog and automate collections and processing.

Download this product brief to learn how FTK 8.1 empowers digital forensic investigators to uncover crucial intelligence by investigating mobile, Windows, and Mac data on a single platform.

Find out about the features that make the FTK Suite of digital forensics solutions the industry leader for corporate and public sector investigations.
Accelerate Your Forensic Investigations with Exterro FTK