Exterro FTK Imager vs Timesketch

Exterro FTK Imager is a forensic imaging and preview tool for acquiring and preserving digital evidence. It creates full disk images in multiple industry-standard formats and verifies them with MD5 or SHA-1 hashes. Investigators can preview files and folders before acquisition, capture volatile RAM and registry data from a live device, and read or write common forensic image formats. Files can be exported for further analysis in FTK Forensic Toolkit. Supported acquisition sources include Windows and Linux hard drives, CDs and DVDs, thumb drives and other USB devices. The tool runs on Windows only, though it can image a Linux device; it does not collect directly from phones or other mobile devices. The free FTK Imager plan is listed at free. FTK Imager Pro costs $499 a year and adds encryption-aware workflows, iOS advanced logical collection, faster preview and targeted acquisition. Exterro identifies incident response and DFIR teams, law enforcement, forensic examiners, and corporate security and HR investigators as intended users.

Timesketch is a free, open-source tool for collaborative forensic timeline analysis. A sketch normally represents one case and can contain multiple timelines, views, comments and stories. Investigators can search and filter timelines, inspect data in charts and save discoveries as views. Sketches may be private or shared with individuals, groups or all system users. Supported imports include Plaso storage files, CSV, JSON, JSONL, Pandas DataFrames, Python dictionaries and spreadsheet files. Python analyzers run in background workers to enrich events, add tags or create saved views; documented integrations include Sigma, Google Safe Browsing, BigQuery, Yeti and HashR. Sigma support is marked alpha with known performance and functionality issues. Timesketch offers a web interface, REST API and command-line client. Docker is the only tested and actively maintained installation method; documentation calls for Ubuntu 22.04 and at least 8 GB of RAM. Indexes depend on physical disk space, and searches may fail above 150 indices in a timeline. The self-hosted plan is free.