FTK Imager

FTK Imager is a data preview and imaging program for Windows that allows you to acquire samples in a forensically sound manner by creating copies of drives without making changes to the original evidence. Please note, it is possible to execute the application from a portable flash drive.

Functionality

The software gives you the ability to create forensic images of local hard drives, DVDs and CDs, removable drives and other USB devices. You can also process entire folders or individual files from various other locations. What is more, you are able to preview the contents of forensic images stored on the computer or on a network drive. If you need to securely transfer your analysis results, you may use a special utility called SafeGuard PrivateCrypto.

Create hashes

Another useful feature is the possibility to create hashes of files using either of the two functions, namely Message Digest 5 and Secure Hash Algorithm. You can generate these reports for regular files and disk images that you may use as a benchmark to prove the integrity of your evidence. When a full drive is imaged, a hash value generated by the tool can be used to verify that the image remained unchanged since acquisition.