Forensic Toolkit (FTK)
Description
Create full-disk forensic images and process a wide range of data types from many sources, from hard drive data to mobile devices, network data and Internet storage, all in a centralized, secure database. FTK® processes and indexes data upfront, eliminating wasted time waiting for searches to execute. Cut down on OCR time by up to 30% with our efficient OCR engine.
The gold standard in digital forensics software
Streamline forensic investigations to locate key evidence and solve complex cases faster.
Most trusted solution in the industry
FTK’s reliable, scalable processing engine gets more evidence into the hands of examiners in less time, allowing them to dig deeper into their data and solve cases faster. With its ability to create custom Python scripts, decrypt files, recover and crack passwords, parse registry files, and carve data to recover deleted evidence, FTK finds the data that other tools can’t.
Mobile Data Processing
Leverage FTK’s powerful processing engine to parse computer and mobile data in a single database to find connections across data sources. FTK supports native unprocessed UFD extractions from mobile devices provided by tools like Cellebrite, Oxygen, XRY or GrayKey. Review chat messages from apps like Twitter and WhatsApp, reconstructed in their near-native view to quickly interpret the conversation.
Multimedia Thumbnail Review
Hover over and click on thumbnails to easily inspect pictures of interest, then label and categorize images easily with keyboard shortcuts. FTK provides context for every image by reconstructing the device user’s activity leading up to and following the creation of the image via built-in mini timelines. FTK’s investigator wellness settings reduce repeated exposure to sensitive content, such as in CSAM cases.
Additional Capabilities
Mac Data Review
Process and analyze datasets containing Apple file systems that are encrypted, compressed or deleted.
Image Identification
Use facial and object recognition to automatically locate images containing that same content.
System Summary Parsing
As Windows captures the timeline of actions of the user, FTK will parse those registry files for you
Portable Case
Export your data into a portable case for offline review by a detective, analyst, attorney or outside reviewer.