Computer forensics: FTK forensic toolkit overview [updated 2019]

In your career as a computer forensics professional, you will often find that your efficiency boils down to which tool you are using for your investigations. Your skill set, as critical as it is to your success, can only take you so far – at the end of the day, you will have to rely on one forensic tool or another. Enter Forensic Toolkit, or FTK. Developed by Access Data, FTK is one of the most admired software suites available to digital forensic professionals. In this article, we will dissect the various features offered by FTK, in addition to discussing its standalone disk imaging tool, FTK Imager. This article will be fruitful for anyone seeking an understanding of FTK. Moreover, it is downright essential for those planning on taking part in Infosec's Computer Forensics Boot Camp.

Learn Digital Forensics

Build your skills with hands-on forensics training for computers, mobile devices, networks and more.

Start Learning

What is forensic toolkit (FTK)?

FTK is intended to be a complete computer forensics solution. It gives investigators an aggregation of the most common forensic tools in one place. Whether you are trying to crack a password, analyze emails, or look for specific characters in files, FTK has got you covered. And, to sweeten the pot further, it comes with an intuitive GUI to boot.

There are a few distinguishing qualities that set FTK apart from the rest of the pack. First and foremost is performance. Subscribing to a distributed processing approach, it is the only forensic software that utilizes multi-core CPUs to parallelize actions. This results in a momentous performance boost; – according to FTK’s documentation, one could cut case investigation time by 400% compared to other tools, in some instances.

Another unique feature of FTK is its use of a shared case database. Rather than having multiple working copies of data sets, FTK uses only a single, central database for a single case. This enables team members to collaborate more efficiently, saving valuable resources. The use of a database also provides stability; unlike other forensics software that solely rely on memory, which is prone to crashing if capacity exceeds limits, FTK’s database allows for persistence of data that is accessible even if the program itself crashes.

Robust searching speeds are another hallmark of FTK. Due to the tool’s emphasis on indexing of files up front, investigators can greatly reduce search times. FTK generates a shared index file, which means that you don’t need to duplicate or recreate files.

Which Tools Does It Contain? What Are Those Tools Used For?

As stated above, FTK is designed as an all-in-one digital forensics solution. Some of its major capabilities include:

• Email analysis

FTK provides an intuitive interface for email analysis for forensic professionals. This includes having the ability to parse emails for certain words, header analysis for source IP address, etc.

• File decryption

A central feature of FTK, file decryption is arguably the most common use of the software. Whether you want to crack passwords or decrypt entire files, FTK has an answer for it. You can retrieve passwords for over 100 applications with FTK.

• Data carving

FTK includes a robust data carving engine. Investigators have the option to search files based on size, data type, and even pixel size.

• Data visualization

Evidence visualization is an up-and-coming paradigm in computer forensics. Rather than analyzing textual data, forensic experts can now use various data visualization techniques to generate a more intuitive picture of a case. FTK empowers such users, with timeline construction, cluster graphs, and geolocation.

• Web viewer

One of the more recent additions to the suite, the FTK Web Viewer is a tool that accelerates case assessments by granting access of case files to attorneys in real time, while evidence is still being processed by FTK. It also allows for multi-case searching, which means that you don’t have to manually cross-reference evidence from different cases.

• Cerberus

Embracing the shift towards analytics, FTK has included a powerful automated malware detection feature called Cerberus. It uses machine intelligence to sniff malware on a computer, subsequently suggesting actions to deal with it if found.

• OCR

Another feature that borrows heavily from AI and computer vision, FTK’s Optical Character Recognition engine allows for fast conversion of images to readable text. Multi-language support is also included.

What is the FTK imager? How is the FTK imager used?

Though we’ve established just how versatile a toolkit FTK is for forensic investigations, it is never a good idea to start feeding it the original files. A sound forensic practice is to acquire copies (images) of the affected system’s data and operate on those copies. To aid in this process, Access Data offers investigators a standalone disk imaging software known as FTK Imager.

In addition to creating images of hard drives, CDs and USB devices, FTK Imager also features data preview capabilities. This can be used to preview both files/folders and the contents residing in those files. FTK Imager also supports image mounting, which enhances its portability. The tool is one of very few that can create multiple file formats: EO1, SMART, or DD raw. You can also easily track activities through its basic text log file.

While creating copies of original disk drives, a critical aspect is to check file integrity. FTK Imager also assists in this area, with support for creating MD5 and SHA1 hashes. Furthermore, you can generate hash reports that can be archived for later use. For instance, if you want to check whether an image has been changed since its acquisition.

Once you’ve created images of disk drives using FTK Imager, you can then move on to a more thorough investigation of the case with FTK.

Where can I download the FTK forensic toolkit and FTK imager?

Access Data has made both FTK and FTK Imager available for download for free, albeit with a caveat. While the FTK Imager can be used for free indefinitely, FTK only works for a limited amount of time without a license. You can also order a demo from Access Data. In any case, you can find both of them on Access Data’s official downloads page. Before you order yourself FTK, though, do note that the requirements of the specifications to run FTK are nothing to sneeze at; you better make sure you have the hardware to run it at its full clip.

The best FTK resources

A traditional strong suit of Access Data has been its ample support through documentation and tutorials. The most relevant resources available on the web regarding FTK are those provided by Access Data itself on its Knowledge Library page. Here, you will find video tutorials on FTK, as well as additional forensic techniques. You can also look at brochures, infographics, and even eBooks to maximize your experience with FTK. Besides first-party support, you may also want to look at external resources like these.

Regarding FTK Imager, you won’t find a lot on Access Data’s official site. But not to worry; you should be able to find plenty of help online. Our favorites are SANS DFIR’s blog post on FTK Imager and eForensics Magazine’s step-by-step guide on FTK Imager (subscription required).

Learn Digital Forensics

Build your skills with hands-on forensics training for computers, mobile devices, networks and more.

Start Learning

Conclusion

FTK is the first software suite that comes to mind when discussing digital forensics. The toolkit offers a wide range of investigative capabilities, enabling professionals to tackle wide-ranging problems. In this article, we saw some of the core features that FTK offers, as well as its accompanying disk imaging solution, FTK Imager. We hope the knowledge you gained from this article helps you become a better forensic specialist.