Select your source type. For a physical drive, choose (recommended for full disk imaging, including unallocated space). For a specific partition, choose Logical Drive .
: A specialized, logical custom content format optimized for filtering and pulling target user directories (e.g., parsing specific user folders rather than an entire drive). 2. Advanced Live Memory (RAM) Forensics ftk imager 3.4.0.1
FTK Imager is a freely available digital forensics acquisition tool developed by Exterro (formerly AccessData). Version 3.4.0.1 is a stable release within the v3.x lineage, widely regarded for its reliability in creating forensic images and previewing data. It serves as the industry standard for acquiring digital evidence in a forensically sound manner, ensuring data integrity through hash verification. Select your source type
If the pre-acquisition and post-acquisition hashes match, the data integrity is legally verified. 3. Live Memory (RAM) Capture : A specialized, logical custom content format optimized
Once an image is loaded (or a live drive attached), the tool presents a familiar directory tree. You can browse files, view folders, and examine file metadata without ever mounting the drive as a writable volume. This prevents accidental modification of timestamps.
FTK Imager 3.4.0.1 is a forensic imaging and preview tool used to acquire, examine, and export data from storage media and images without altering original evidence. It supports live memory capture, physical and logical imaging, and provides hashing, file carving, and preview capabilities.
When you use FTK Imager 3.4.0.1 in litigation, your workflow must be defensible. The tool supports sound practices: