Forensic Toolkit® (FTK®) is recognized around the world as the standard in computer forensics software. This court-validated digital investigations platform delivers cutting-edge computer forensic analysis, decryption and password cracking all within an intuitive and customizable interface. FTK 3 is built for speed, analytics and enterprise-class scalability. Known for its intuitive interface, email analysis, customizable data views and stability, FTK lays the framework for seamless expansion, so your computer forensics solution can grow with your organization’s needs. Forensic Toolkit 3 is now the most advanced computer forensics software available, providing functionality that normally only organizations with tens of thousands of dollars could afford. However, we are committed to making our technology available to all investigators and analysts, whether they are in law enforcement, education, a government agency, a Fortune 500 corporation, or performing digital investigations as computer forensics service provider.
An Integrated Computer Forensics Solution
Create images, analyze the registry, conduct an investigation, decrypt files, crack passwords, identify steganography, and build a report all with a single solution.
Recover passwords from 100+ applications; harness idle CPUs across the network to decrypt files and perform robust dictionary attacks.
KFF hash library with 45 million hashes.
Enterprise-class Architecture
Supports the largest, most complex datasets.
Never lose work due to a crash, because the FTK components are compartmentalized. (Example: If the GUI crashes, the Workers continue to process data.)
Ability to back up and archive cases.
Every copy of FTK 3 includes a total of 4 Workers to enable distributed processing – 1 on the examiner machine and 3 distributed.
NOTE: FTK does not support a configuration that allows multiple FTK licenses to share common processing workers or a common Oracle database. These configurations will cause significant errors. If you are interested in having multiple examiners share common workers and a central database, please refer to the AccessData Lab solution.
Distributed Processing obviously requires powerful hardware and networking technology. Processing evidence is very disk IO intensive and requires fast drives. In addition, the machine that runs the Processing Manager must be the fastest computer (CPU) speed in the processing group. Finally, you will need the fastest networking technology available to you. For details on configuring distributed processing, please see the following documents:
Configuring Distributed Processing with FTK 3
FTK 3 System Specifications Guide
The solution easily expands to incorporate Lab capabilities, such as the ability to leverage a centralized database infrastructure and shared distributed processing farm, as well as collaborative forensic analysis, central case/task management and Web review. This is of particular value to law enforcement and government computer forensics labs.
Powerful Processing and Speed
The GUI is 10 times more responsive.
Distributed Processing allows you to leverage up to 3 additional computers to dramatically reduce processing time and tackle massive data sets.
True multi-processor and multi-threading support that takes advantage of hardware advancements.
Wizard-driven processing ensures no data is missed.
Cancel/Pause/Resume functionality
Better real-time processing status
CPU resource throttling
New email notification upon processing completion
Pre- and post-processing refinement allows you to control how images are processed.
Advanced data carving engine allows you to carve allocated and unallocated data and specify criteria, such as file size, data type and pixel size to reduce the amount of irrelevant data carved while increasing overall thoroughness.
Optimized dtSearch integration delivers fast indexing and fast search results.
The Most Advanced Analytics
RAM Dump Analysis
Enumerate all running processes, including those hidden by rootkits, and display associated DLLs, network sockets and handles in context, from 32-bit windows machines.
For each process it will display: Name | Path | Start Time | Working Directory | Command Line| ProcessID | ParentID | MD5 | SHA1 | Fuzzy Hash | Size | Windows Title
For each DLL: Name | Path | Process Name | ProcessID | ParentID |
For Network Socket: Port | Protocol | Local Address | Remote Address | Remote Port | Process Name | ProcessID
For Open Handles: Handle Type | Path | Access Mask | ProcessID
Dump a process and associated DLLs for further analysis in third-party tools.
Memory string search allows you to identify hits in memory and automatically map them back to a given process, DLL or piece of unallocated and dump the corresponding item.
Process RAM captures for additional forensic artifacts, such as passwords, html pages, .lnk files and MS Office documents.
Powerful index search engine and a proper full-feature regular expression engine for binary searches.
Broad file system, compound file and email support.
Currently supported email types are: Notes NSF, Outlook PST/OST, Exchange EDB, Outlook Express DBX, Eudora, EML (Microsoft Internet Mail, Earthlink, Thunderbird, Quickmail, etc.), Netscape, AOL and RFC 833
Supports popular encryption technologies, such as Credant, SafeBoot, Utimaco, EFS, PGP and Guardian Edge.
Automatically identify potentially pornographic images, using the Explicit Image Detection (EID) add-on.
Comprehensive Mac support
Process B-Trees attributes for metadata
PLIST support
SQLite database support
Apple DMG and DD_DMG disk image support
Crack Sparse Images or Sparse Bundles
JSON file support
Preview, Acquisition and Analysis of LIVE DATA
Perform network-based, secure, single-system forensic acquisition of physical devices, logical volumes and RAM.
The agent is easy to deploy.
Doesn’t require a cumbersome installation and authentication process.
Secure Remote Device Mounting
Intuitive Interface and Rich Functionality
Easy-to-understand and easy-to-use GUI with pre-defined and customizable data views, advanced digital evidence filtering, dockable windows and automated data categorization.
Multiple data views allow users to analyze files in a number of different ways, such as native, hex, text and filtered.
Full Unicode and Code Page support.
Create detailed reports and output them into native format, HTML, PDF, XML, RTF, and more - with links back to the original evidence.
Define Registry Supplemental Reports (RSR) During Pre-processing or Additional Analysis:
Clear reporting on what files could not be processed or indexed with the Processing Exception/Case Info report.
Create a CSV of the processed files that can be imported into Excel or a database application.
