FTK Imager

Description

FTK Imager is a free forensic imaging tool by Exterro (formerly AccessData) that creates forensically sound disk images in E01, SMART, DD, and AFF formats. It previews evidence, mounts images, calculates hash values for integrity verification, and exports files without modifying the source.

Use Cases

• Create forensically sound disk images with hash verification
• Preview evidence on drives without altering data
• Export specific files from disk images for analysis

Attack Phases

MITRE ATT&CK Techniques (1)