Skip to content
SPECIFICTION
Get listed

Exterro FTK Imager

exterro.com

From $41.58/mo Free plan WebWindows
Visit exterro.com
Spec score 8.2 #8 of 30 in Digital Forensics Software

What it is

Exterro FTK Imager is a forensic imaging and preview tool for acquiring and preserving digital evidence. It creates full disk images in multiple industry-standard formats and verifies them with MD5 or SHA-1 hashes. Investigators can preview files and folders before acquisition, capture volatile RAM and registry data from a live device, and read or write common forensic image formats. Files can be exported for further analysis in FTK Forensic Toolkit. Supported acquisition sources include Windows and Linux hard drives, CDs and DVDs, thumb drives and other USB devices. The tool runs on Windows only, though it can image a Linux device; it does not collect directly from phones or other mobile devices. The free FTK Imager plan is listed at free. FTK Imager Pro costs $499 a year and adds encryption-aware workflows, iOS advanced logical collection, faster preview and targeted acquisition. Exterro identifies incident response and DFIR teams, law enforcement, forensic examiners, and corporate security and HR investigators as intended users.

Spec sheet

Purpose
FTK Imager is a forensic imaging and preview tool for acquiring and preserving digital evidence.Read 28 Sep 2026 · exterro.com
Headquarters
Portland, Oregon, United StatesRead 28 Sep 2026 · exterro.com
Company security
Exterro’s Trust Center lists ISO 27001:2022, SOC 2, FedRAMP Moderate, TISAX, HITRUST, and UK Cyber Essentials 3.2; these are company-level disclosures.Read 28 Sep 2026 · trustcenter.exterro.com
Disk imaging
It can create full disk images in multiple industry standard formats and verify them with hashes.Read 28 Sep 2026 · exterro.com
Evidence validation
The product page says FTK Imager uses MD5 or SHA-1 hash functions for validation.Read 28 Sep 2026 · exterro.com
File export
It can read and write common forensic image formats and export files for further analysis in FTK Forensic Toolkit.Read 28 Sep 2026 · exterro.com
Memory capture
It can capture volatile RAM and registry data from a live device.Read 28 Sep 2026 · exterro.com
Mobile limit
FTK Imager does not collect directly from cell phones or mobile devices; Exterro says mobile extractions require a separate tool.Read 28 Sep 2026 · exterro.com
Operating system limit
FTK Imager runs on Windows only and cannot be installed on Linux, though it can image a Linux device.Read 28 Sep 2026 · exterro.com
Paid upgrade
FTK Imager Pro adds encryption-aware workflows, iOS advanced logical collection, faster preview, and targeted acquisition.Read 28 Sep 2026 · go.exterro.com
Preview and triage
Users can preview files and folders before full acquisition to identify relevant evidence.Read 28 Sep 2026 · exterro.com
Support and training
Exterro directs technical support questions to its support portal and offers an on-demand FTK Imager training course.Read 28 Sep 2026 · exterro.com
Supported acquisition sources
It can preview and image Windows and Linux hard drives, CDs and DVDs, thumb drives, and other USB devices.Read 28 Sep 2026 · exterro.com
Target users
Exterro names incident response and DFIR teams, law enforcement and forensic examiners, and corporate security and HR investigators as users.Read 28 Sep 2026 · exterro.com

Plans and prices

FTK Imager Free Free forensic imaging and preview tool · Windows only Read 28 Sep 2026 · exterro.com
FTK Imager Pro $499 a year Annual subscription $499/user Paid upgrade · iOS advanced logical collection · encryption detection and decryption · targeted acquisition Read 28 Sep 2026 · store.exterro.com

Every Exterro FTK Imager plan and price →

Strong points and limits

Strong points

  • Creates full disk images and verifies them with hashes
  • Previews files and folders before acquisition
  • Captures volatile RAM and registry data
  • Exports files for analysis in FTK Forensic Toolkit

Limits

  • Runs on Windows only
  • Does not collect directly from mobile devices
  • FTK Imager Pro costs $499 a year

Who it suits

FTK Imager suits incident response and DFIR teams, law enforcement, forensic examiners, and corporate security or HR investigators working with supported evidence sources.

Verdict

FTK Imager combines imaging, preview, validation and live-device memory capture for supported sources. Its Windows-only installation and lack of direct mobile collection are important boundaries; mobile extractions require a separate tool.

Where Specifiction places it

Alternatives to Exterro FTK ImagerAll alternatives →