Exterro FTK Imager vs SUMURI PALADIN

Exterro FTK Imager is a forensic imaging and preview tool for acquiring and preserving digital evidence. It creates full disk images in multiple industry-standard formats and verifies them with MD5 or SHA-1 hashes. Investigators can preview files and folders before acquisition, capture volatile RAM and registry data from a live device, and read or write common forensic image formats. Files can be exported for further analysis in FTK Forensic Toolkit. Supported acquisition sources include Windows and Linux hard drives, CDs and DVDs, thumb drives and other USB devices. The tool runs on Windows only, though it can image a Linux device; it does not collect directly from phones or other mobile devices. The free FTK Imager plan is listed at free. FTK Imager Pro costs $499 a year and adds encryption-aware workflows, iOS advanced logical collection, faster preview and targeted acquisition. Exterro identifies incident response and DFIR teams, law enforcement, forensic examiners, and corporate security and HR investigators as intended users.

SUMURI PALADIN is a donation-supported live Linux environment for forensic imaging, triage, and recovery. PALADIN 9 LTS uses Ubuntu 24.04 LTS and is modified to prevent changes to attached media and disable automatic mounting at boot. Its graphical Toolbox handles imaging, logical acquisitions, hashing, and device mounting, with read-only options and logging. Included software includes Autopsy, The Sleuth Kit, and other open-source forensic tools. Supported image formats include E01/Ex01, RAW (.dd), SMART, AFF, VHD, and VMDK. PALADIN LTS can mount and image through NFS or SMB networks and supports BitLocker-encrypted Windows partitions from Vista through Windows 10. It integrates Arsenal Image Mounter Remote Agent for advanced mounting and live or remote analysis. Persistent Mode preserves reports and configurations between prepared sessions, subject to extra free space. PALADIN runs as a Linux live environment on 64-bit and 32-bit PC hardware.