Side by side

Arkime vs Exterro FTK Imager

Both stand on digital forensics software. Which one you can start free with, which one lets you read the code, and what each costs once you pay.

Arkime

Free plan Open source APILinuxSelf-hosted+1

Arkime offers session search, packet inspection, and flexible packet retention without license fees. It requires an OpenSearch or Elasticsearch deployment, so teams should account for that dependency and its operation.

Visit Arkime

Exterro FTK Imager

Free plan WebWindows

FTK Imager provides imaging, preview, validation, and live memory capture for digital investigations. Its Windows-only installation and lack of direct mobile collection are important limits to consider.

Visit Exterro FTK Imager

The facts

	Arkime	Exterro FTK Imager
Free plan	Yes	Yes
Open source	Yes	Not published
Runs on	API, Linux, Self-hosted, Web	Web, Windows
Lowest paid plan	Free or on request	FTK Imager Pro: $499 per user a year
Plans published	1	2
Maker	Not published	Not published
Website	arkime.com	exterro.com
On digital forensics software	#1 of 30	#5 of 30

Arkime: what it does well

Stores full packets in standard PCAP format.
Supports metadata-only capture with traffic selection rules.
Exports search results as PCAP or CSV.
Capture can scale with more machines, CPU, or disk.
Authentication options include OIDC.

What to know first

Requires OpenSearch or Elasticsearch for session metadata.
Phone indicator enrichment is limited to the U.S.
Anonymous authentication is not recommended.

Exterro FTK Imager: what it does well

Creates disk images and validates them with MD5 or SHA-1.
Previews files and folders before full acquisition.
Captures volatile RAM and registry data from live devices.
Base FTK Imager plan is listed as free.

What to know first

Runs on Windows only, though it can image Linux devices.
Does not collect directly from phones or mobile devices.
Pricing for the product is listed as on request.

Alternatives to Arkime Alternatives to Exterro FTK Imager The whole list