Skip to content

FTK Imager

What FTK Imager does

Forensic acquisition and preview

FTK Imager is a Windows forensic acquisition and preview utility. It can create physical or logical images, preview supported evidence sources, export selected files and verify acquired images without requiring a full FTK installation.

Guide scope

This guide uses FTK Imager to create a logical E01 image in an authorised training environment. The original installation and imaging screenshots remain in their procedural pages.

Protect the source

Use disposable training media or an explicitly authorised source. Apply an appropriate write-protection method where required, record unavoidable live-system changes, and never use the source volume as the destination.

Choose your journey

01Install and open

Obtain FTK Imager, complete installation and confirm the application opens.

Complete when the Evidence Tree and File List are visible.Beginner · Windows workstation · 15–25 min 02Create and verify an image

Select a source, configure E01 output and retain the verification summary.

Complete when the image and acquisition log can be reviewed.Guided · Training source · Time varies 03Interactive Lab

Practise the imaging wizard in a browser-based FTK Imager simulation.

Complete when the image plan passes its verification review.Beginner · No installation · 15–25 min 04Full Lab

Acquire a small training source and produce a reviewable evidence package.

Complete when another analyst can verify the acquisition.Intermediate · Isolated Windows lab · 60–120 min

Evidence workflow

1Authorise›2Protect source›3Acquire image›4Verify output›5Preserve evidence
  • Authorise: Record the case question and identify the exact source.
  • Protect: Document write protection and keep output away from the source.
  • Acquire: Select the proportionate image type and retain the settings used.
  • Verify: Compare recorded hashes and review the acquisition log and errors.
  • Preserve: Protect the image, log and context; analyse a verified working copy.

Before you begin

  • Source
    A small disposable training drive, volume or supplied image.
  • Destination
    A separate controlled volume with sufficient free space.
  • Record
    Tool version, source identity, case reference, time, settings, hashes and errors.

What the result can support

Supported conclusion

FTK Imager can demonstrate what was acquired, which settings were used and whether recorded verification values agree.

Interpretation limit

A successful acquisition does not by itself establish user intent, authorship or that every relevant source was available.