Exterro FTK Imager Pro

FTK Imager Pro is a forensic imaging and data acquisition tool designed for digital forensics and incident response workflows. The tool creates forensic disk images of hard drives, solid-state drives, USB drives, memory cards, and RAM while maintaining data integrity through hash value generation and verification. The Pro version adds iOS advanced logical collection capabilities, enabling acquisition of photos, messages, app data, and call logs from iOS devices. It includes encryption detection and decryption features for BitLocker-encrypted images, allowing investigators to decrypt and view encrypted data with proper credentials. The tool supports live decryption functionality, which enables users to view or acquire decrypted BitLocker data directly from target devices without performing full disk imaging. This feature is designed to accelerate triage and incident response activities. FTK Imager Pro includes file and folder preview capabilities, evidence file mounting for review, and write-blocking features to preserve chain of custody. The tool generates hash values before and after acquisition with logging to support evidentiary integrity requirements for court-admissible evidence collection. The product uses a virtual license model tied to individual systems and requires annual renewal. A free version of FTK Imager remains available with basic imaging and validation functionality, while the Pro version is targeted at incident response teams, law enforcement, digital forensic examiners, corporate security investigators, and eDiscovery professionals.