Exterro FTK Imager vs Hayabusa

Exterro FTK Imager is a forensic imaging and preview tool for acquiring and preserving digital evidence. It creates full disk images in multiple industry-standard formats and verifies them with MD5 or SHA-1 hashes. Investigators can preview files and folders before acquisition, capture volatile RAM and registry data from a live device, and read or write common forensic image formats. Files can be exported for further analysis in FTK Forensic Toolkit. Supported acquisition sources include Windows and Linux hard drives, CDs and DVDs, thumb drives and other USB devices. The tool runs on Windows only, though it can image a Linux device; it does not collect directly from phones or other mobile devices. The free FTK Imager plan is listed at free. FTK Imager Pro costs $499 a year and adds encryption-aware workflows, iOS advanced logical collection, faster preview and targeted acquisition. Exterro identifies incident response and DFIR teams, law enforcement, forensic examiners, and corporate security and HR investigators as intended users.

Hayabusa is a free, open-source tool for Windows event log forensics and threat hunting. It processes EVTX logs from one host or thousands into CSV, JSON or JSONL timelines. Analysis features include computer and event ID metrics, logon summaries, keyword pivoting, HTML summary reports and MITRE ATT&CK mapping. It supports the Sigma specification, including v2 correlation rules; the project describes its curated detection rules as numbering over 4,000. The project says its multithreaded Rust implementation can deliver up to a 5x speed improvement and describes Rust as memory-safe. Hayabusa can run live on one system, process collected logs offline or hunt across endpoints through the Velociraptor Hayabusa artifact. Results can be imported into Elastic Stack, Timesketch and Timeline Explorer, while JSON can be analyzed with jq. Special Windows live-response packages bundle the program with encoded rules and configuration files to reduce files written to the system and help avoid antivirus false positives on YAML rule files. It runs on Windows, macOS and Linux, but no Linux ARM MUSL binary is provided because it does not run properly. The software uses AGPLv3; detection rules use DRL 1.1.