Exterro FTK Imager
Exterro FTK Imager is a forensic imaging and preview tool for collecting and preserving digital evidence.
What Exterro FTK Imager is
Exterro FTK Imager is a forensic imaging and preview tool for collecting and preserving digital evidence. It can create full disk images in industry-standard formats and verify them with MD5 or SHA-1 hashes. Investigators can preview files and folders before acquisition, capture volatile RAM and registry data from a live device, and export files for further analysis in FTK Forensic Toolkit. Supported sources include Windows and Linux hard drives, CDs and DVDs, thumb drives, and other USB devices. The free FTK Imager plan is free. FTK Imager Pro costs $499 a year and adds encryption-aware workflows, iOS advanced logical collection, faster preview, and targeted acquisition. The software runs on Windows only, though it can image Linux devices; it does not collect directly from phones or other mobile devices. Exterro identifies incident response and DFIR teams, law enforcement, forensic examiners, and corporate security and HR investigators as users.
Good
- Creates disk images and verifies them with hashes.
- Previews files and folders before full acquisition.
- Captures live-device RAM and registry data.
- Free plan is listed as free.
Watch out
- Runs on Windows only.
- Does not collect directly from mobile devices.
- FTK Imager Pro costs $499 a year.
- Pricing is listed as on request.
Who it suits
FTK Imager suits incident response and DFIR teams, law enforcement, forensic examiners, and corporate security or HR investigators who need to acquire and inspect digital evidence.
Verdict
FTK Imager covers imaging, preview, and memory capture for supported sources, with a free plan and a paid Pro upgrade. Its Windows-only installation and lack of direct mobile collection are important limits to weigh.
Plans and prices
From Exterro FTK Imager's own pricing page, checked 28 Sep 2026.
| Plan | Price | What it gives you |
|---|---|---|
| FTK Imager | Free | Free forensic imaging and preview tool · Windows only |
| FTK Imager Pro | $499 a year | Paid upgrade · iOS advanced logical collection · encryption detection and decryption · targeted acquisition · Annual subscription $499/user |
The facts
Each one read from Exterro FTK Imager's own pages, with the date it was checked.
The company
- Company security
- Exterro’s Trust Center lists ISO 27001:2022, SOC 2, FedRAMP Moderate, TISAX, HITRUST, and UK Cyber Essentials 3.2; these are company-level disclosures.checked 28 Sep 2026
- Headquarters
- Portland, Oregon, United Stateschecked 28 Sep 2026
What it does
- Disk imaging
- It can create full disk images in multiple industry standard formats and verify them with hashes.checked 28 Sep 2026
- Evidence validation
- The product page says FTK Imager uses MD5 or SHA-1 hash functions for validation.checked 28 Sep 2026
- File export
- It can read and write common forensic image formats and export files for further analysis in FTK Forensic Toolkit.checked 28 Sep 2026
- Memory capture
- It can capture volatile RAM and registry data from a live device.checked 28 Sep 2026
- Mobile limit
- FTK Imager does not collect directly from cell phones or mobile devices; Exterro says mobile extractions require a separate tool.checked 28 Sep 2026
- Operating system limit
- FTK Imager runs on Windows only and cannot be installed on Linux, though it can image a Linux device.checked 28 Sep 2026
- Paid upgrade
- FTK Imager Pro adds encryption-aware workflows, iOS advanced logical collection, faster preview, and targeted acquisition.checked 28 Sep 2026
- Preview and triage
- Users can preview files and folders before full acquisition to identify relevant evidence.checked 28 Sep 2026
- Purpose
- FTK Imager is a forensic imaging and preview tool for acquiring and preserving digital evidence.checked 28 Sep 2026
- Support and training
- Exterro directs technical support questions to its support portal and offers an on-demand FTK Imager training course.checked 28 Sep 2026
- Supported acquisition sources
- It can preview and image Windows and Linux hard drives, CDs and DVDs, thumb drives, and other USB devices.checked 28 Sep 2026
- Target users
- Exterro names incident response and DFIR teams, law enforcement and forensic examiners, and corporate security and HR investigators as users.checked 28 Sep 2026
Alternatives to Exterro FTK Imager
- 1
Arkime
Free planOpen sourceWebAPILinuxSelf-hosted7.3Free plan - 2
Plaso
Free planOpen sourceAPILinuxmacOSSelf-hosted7.3Free plan - 3
CAINE
Free planOpen sourceLinuxSelf-hostedWindows7.1Free plan - 4
Paraben E3 Forensic Platform
AndroidiOSLinuxmacOS7.1From $699 a year - 5
OSForensics
Free planAndroidSelf-hostedWindows7.0From $945 a year - 6
NetworkMiner
Free planLinuxmacOSWindows6.9$1,300 one-time