Freedom251 › Digital Forensics Software
Exterro FTK Imager
What Exterro FTK Imager is
Exterro FTK Imager is a forensic imaging and preview tool for acquiring and preserving digital evidence. It creates full disk images in industry-standard formats and checks them using MD5 or SHA-1 hashes. Investigators can preview files and folders before full acquisition to identify relevant material. The tool can also capture volatile RAM and registry data from a live device, read and write common forensic image formats, and export files for analysis in FTK Forensic Toolkit. Supported sources include Windows and Linux hard drives, CDs and DVDs, thumb drives, and other USB devices. FTK Imager runs on Windows only, although it can image Linux devices, and it does not collect directly from phones or other mobile devices. Exterro lists the base FTK Imager plan at no cost. FTK Imager Pro costs $499 a year and adds encryption-aware workflows, iOS advanced logical collection, faster preview, and targeted acquisition. Exterro identifies incident response and DFIR teams, law enforcement, forensic examiners, and corporate security and HR investigators as users.
Who it suits
FTK Imager suits incident response and DFIR teams, law enforcement and forensic examiners, and corporate security or HR investigators who need to image and preview digital evidence.
What it does well
- Creates disk images and validates them with MD5 or SHA-1.
- Previews files and folders before full acquisition.
- Captures volatile RAM and registry data from live devices.
- Base FTK Imager plan is listed as free.
What to know first
- Runs on Windows only, though it can image Linux devices.
- Does not collect directly from phones or mobile devices.
- Pricing for the product is listed as on request.
Limits
The free FTK Imager plan is a Windows-only imaging and preview tool. It does not collect directly from mobile devices; FTK Imager Pro is listed at $499 a year and adds iOS advanced logical collection, encryption-aware workflows, faster preview, and targeted acquisition.
Plans
| Plan | Billed and limits | Price |
|---|---|---|
| FTK Imager | Free forensic imaging and preview tool · Windows only | Free |
| FTK Imager Pro | Annual subscription $499/user · Paid upgrade · iOS advanced logical collection · encryption detection and decryption · targeted acquisition | $499 a year |
As exterro.com lists them, read 28 Sept 2026. The maker's own page has the final word.
Getting started
- Open the FTK Imager product page at https://www.exterro.com/digital-forensics-software/ftk-imager.
- Choose the free FTK Imager plan or the FTK Imager Pro annual subscription.
- Install FTK Imager on Windows.
- Use its preview or imaging functions with a supported acquisition source.
- Contact Exterro's support portal for technical support, or take its on-demand training course.
Verdict
FTK Imager provides imaging, preview, validation, and live memory capture for digital investigations. Its Windows-only installation and lack of direct mobile collection are important limits to consider.
Questions
How much does FTK Imager cost?
The FTK Imager plan is listed as free. FTK Imager Pro is listed at $499 a year.
Is there a free plan or trial?
There is a free FTK Imager plan. The listed free trial is no.
What platforms does FTK Imager run on?
FTK Imager runs on Windows only. It can image Linux devices but cannot be installed on Linux.
Can it collect evidence from mobile devices?
It does not collect directly from cell phones or mobile devices. Exterro says mobile extractions require a separate tool.
What does FTK Imager Pro add?
The paid upgrade adds encryption-aware workflows, iOS advanced logical collection, faster preview, and targeted acquisition.
Who makes FTK Imager?
Exterro makes FTK Imager. Its headquarters are in Portland, Oregon, United States.
Facts from Exterro FTK Imager's own pages
- Company security
- Exterro’s Trust Center lists ISO 27001:2022, SOC 2, FedRAMP Moderate, TISAX, HITRUST, and UK Cyber Essentials 3.2; these are company-level disclosures. · trustcenter.exterro.com, 28 Sept 2026
- Disk imaging
- It can create full disk images in multiple industry standard formats and verify them with hashes. · exterro.com, 28 Sept 2026
- Evidence validation
- The product page says FTK Imager uses MD5 or SHA-1 hash functions for validation. · exterro.com, 28 Sept 2026
- File export
- It can read and write common forensic image formats and export files for further analysis in FTK Forensic Toolkit. · exterro.com, 28 Sept 2026
- Headquarters
- Portland, Oregon, United States · exterro.com, 28 Sept 2026
- Memory capture
- It can capture volatile RAM and registry data from a live device. · exterro.com, 28 Sept 2026
- Mobile limit
- FTK Imager does not collect directly from cell phones or mobile devices; Exterro says mobile extractions require a separate tool. · exterro.com, 28 Sept 2026
- Operating system limit
- FTK Imager runs on Windows only and cannot be installed on Linux, though it can image a Linux device. · exterro.com, 28 Sept 2026
- Paid upgrade
- FTK Imager Pro adds encryption-aware workflows, iOS advanced logical collection, faster preview, and targeted acquisition. · go.exterro.com, 28 Sept 2026
- Preview and triage
- Users can preview files and folders before full acquisition to identify relevant evidence. · exterro.com, 28 Sept 2026
- Purpose
- FTK Imager is a forensic imaging and preview tool for acquiring and preserving digital evidence. · exterro.com, 28 Sept 2026
- Support and training
- Exterro directs technical support questions to its support portal and offers an on-demand FTK Imager training course. · exterro.com, 28 Sept 2026
- Supported acquisition sources
- It can preview and image Windows and Linux hard drives, CDs and DVDs, thumb drives, and other USB devices. · exterro.com, 28 Sept 2026
- Target users
- Exterro names incident response and DFIR teams, law enforcement and forensic examiners, and corporate security and HR investigators as users. · exterro.com, 28 Sept 2026
Where Exterro FTK Imager stands on Freedom251
- Digital Forensics Software#5 of 30