- Home
- Digital Forensics Software
- Exterro FTK Imager
Exterro FTK Imager
Portland, Oregon, United States
What it is
Exterro FTK Imager is a forensic imaging and preview tool for acquiring and preserving digital evidence. It can create full disk images in industry-standard formats and verify them using MD5 or SHA-1 hashes. Investigators can preview files and folders before a full acquisition to identify relevant material. The tool can also capture volatile RAM and registry data from a live device, read and write common forensic image formats, and export files for further analysis in FTK Forensic Toolkit. Supported sources include Windows and Linux hard drives, CDs and DVDs, thumb drives, and other USB devices. FTK Imager runs on Windows only, though it can image a Linux device; it does not collect directly from phones or other mobile devices. The free FTK Imager plan is listed as free. FTK Imager Pro costs $499 a year and adds encryption-aware workflows, iOS advanced logical collection, faster preview, and targeted acquisition. Exterro identifies incident response and DFIR teams, law enforcement, forensic examiners, and corporate security and HR investigators as users.
For and against
For
- Free imaging and preview plan
- Can verify images with MD5 or SHA-1 hashes
- Captures volatile RAM and registry data
- Can preview and image Linux drives
- Exports files for FTK Forensic Toolkit analysis
Against
- Runs on Windows only
- Does not collect directly from mobile devices
- FTK Imager Pro costs $499 a year
The verdict
FTK Imager offers imaging, preview, and live memory capture, with a free plan and a paid Pro upgrade. Its Windows-only installation and lack of direct mobile collection are important constraints.
Who it suits
FTK Imager suits forensic examiners, incident response and DFIR teams, law enforcement, and corporate security or HR investigators working with digital evidence.
Plans and prices
FTK Imager
Free forensic imaging and preview tool · Windows only
Read 28 Sep 2026 · exterro.com
FTK Imager Pro
Paid upgrade · iOS advanced logical collection · encryption detection and decryption · targeted acquisition
Read 28 Sep 2026 · store.exterro.com
On the record
- Company security
- Exterro’s Trust Center lists ISO 27001:2022, SOC 2, FedRAMP Moderate, TISAX, HITRUST, and UK Cyber Essentials 3.2; these are company-level disclosures.trustcenter.exterro.com · read 28 Sep 2026
- Disk imaging
- It can create full disk images in multiple industry standard formats and verify them with hashes.exterro.com · read 28 Sep 2026
- Evidence validation
- The product page says FTK Imager uses MD5 or SHA-1 hash functions for validation.exterro.com · read 28 Sep 2026
- File export
- It can read and write common forensic image formats and export files for further analysis in FTK Forensic Toolkit.exterro.com · read 28 Sep 2026
- Memory capture
- It can capture volatile RAM and registry data from a live device.exterro.com · read 28 Sep 2026
- Mobile limit
- FTK Imager does not collect directly from cell phones or mobile devices; Exterro says mobile extractions require a separate tool.exterro.com · read 28 Sep 2026
- Operating system limit
- FTK Imager runs on Windows only and cannot be installed on Linux, though it can image a Linux device.exterro.com · read 28 Sep 2026
- Paid upgrade
- FTK Imager Pro adds encryption-aware workflows, iOS advanced logical collection, faster preview, and targeted acquisition.go.exterro.com · read 28 Sep 2026
- Preview and triage
- Users can preview files and folders before full acquisition to identify relevant evidence.exterro.com · read 28 Sep 2026
- Purpose
- FTK Imager is a forensic imaging and preview tool for acquiring and preserving digital evidence.exterro.com · read 28 Sep 2026
- Support and training
- Exterro directs technical support questions to its support portal and offers an on-demand FTK Imager training course.exterro.com · read 28 Sep 2026
- Supported acquisition sources
- It can preview and image Windows and Linux hard drives, CDs and DVDs, thumb drives, and other USB devices.exterro.com · read 28 Sep 2026
- Target users
- Exterro names incident response and DFIR teams, law enforcement and forensic examiners, and corporate security and HR investigators as users.exterro.com · read 28 Sep 2026
