// arsenal·Forensics & REBeginnerFreemium

FTK Imager

Exterro's free disk-imaging utility — the de facto standard for forensic disk capture.

Forensics & RE

$ ftk-imager --help

FTK Imager

// what it is

Description

Free imaging tool from Exterro (formerly AccessData). Mounts forensic images (E01, RAW, AFF), captures live RAM, and previews files inside image formats.

// use cases

What people use it for

Forensic disk acquisition
Live RAM capture
Image preview before analysis

// facts

category: Forensics & RE
platforms: WIN · MAC
license: Freemium
difficulty: Beginner

// links

Official site

// related in Forensics & RE

Forensics & REAdvanced

Volatility

Open-source memory-forensics framework — reads RAM images and reconstructs system state.

FOSS

LIN·WIN·MAC

open entry →

Forensics & REIntermediate

Autopsy

Open-source digital-forensics GUI on top of The Sleuth Kit.

FOSS

LIN·WIN·MAC

open entry →

Forensics & REAdvanced

Ghidra/ghee-druh/

NSA's open-source reverse-engineering platform with a strong decompiler.

FOSS

LIN·WIN·MAC

open entry →