FTK Imager is a data preview and imaging tool used to acquire data (evidence) in a forensically sound manner by creating copies of data without making changes to the original evidence.

Download FTK Imager from :-

www.ramyashah.in/FTKImager.exe
or
[ Ссылка ]

~ The Source in FTK Imager include :

1) Physical Drive :- Includes all types of storage medias and recovers all deleted, unallocated files too.
2)Logical Drive :- The Partition within our system can be selected.
3)Image File :- A specific Image file.
4)Contents of Folder :- Specific Folders of a particular user or org. can be selected
5)Fernico Device :- Multiple CDs/DVDs can be opted.


~ FTK Imager will :

- Create forensic images of local hard drives, CDs and DVDs, thumb drives or other USB devices, entire folders, or individual files from various places within the media.

- Preview files and folders on local hard drives, network drives, CDs and DVDs, thumb drives or other USB devices.

-Export files and folders from forensic images.

-See and recover files that have been deleted from the Recycle Bin, but have not yet been overwritten on the drive.

-Create hashes of files to check the integrity of the data by using either of the two hash functions available in FTK Imager: Message Digest 5 (MD5) and Secure Hash Algorithm (SHA-1).

-Generate hash reports for regular files and disk images (including files inside disk images) that you can later use as a benchmark to prove the integrity of your case evidence. When a full drive is imaged, a hash generated by FTK Imager can be used to verify that the image hash and the drive hash match after the image is created, and that the image has remained unchanged since acquisition.

свернуть