FTK Forensic Toolkit

The gold standard in digital forensics software for repeatable, defensible full-disk image collection, processing and review

Streamline forensic investigations to locate key evidence and solve complex cases faster.

Seconds matter in critical investigations. FTK gives investigators a head start by pointing them directly to the artifacts that matter most, narrowing down the scope of their investigation, and reducing the time it takes to close cases.

Be Instantly Productive

FTK’s intuitive interface design makes it easier for both experienced investigators and non-technical users to navigate within the software, dramatically reducing the learning curve for all skill levels.

Find More Artifacts

Eliminate the hours spent manually digging for the data types you’re interested in. FTK intelligently categorizes and displays the most data artifacts to help you pinpoint key evidence faster.

Search Evidence Faster

Since evidence is processed and indexed up front, you don’t have to wait for index searches to execute during your review. Filter and search evidence faster and more consistently than in any other solution.

Quickly locate, collect, and analyze digital evidence with the most trusted solution in the industry.

FTK’s reliable, scalable processing engine gets more evidence into the hands of examiners in less time, allowing them to dig deeper into their data and solve cases faster. With its ability to create custom Python scripts, decrypt files, recover and crack passwords, parse registry files, and carve data to recover deleted evidence, FTK finds the data that other tools can’t.

Investigate mobile device evidence and review chat app data with Mobile Data Processing.

Leverage FTK’s powerful processing engine to parse computer and mobile data in a single database to find connections across data sources. FTK supports native unprocessed UFD extractions from mobile devices provided by tools like Cellebrite, Oxygen, XRY or GrayKey. Review chat messages from apps like Twitter and WhatsApp, reconstructed in their near-native view to quickly interpret the conversation.

Effortlessly pivot through image and video case evidence with Multimedia Thumbnail Review.

Hover over and click on thumbnails to easily inspect pictures of interest, then label and categorize images easily with keyboard shortcuts. FTK provides context for every image by reconstructing the device user’s activity leading up to and following the creation of the image via built-in mini timelines. FTK’s investigator wellness settings reduce repeated exposure to sensitive content, such as in CSAM cases.