Forensic Toolkit

{{Short description|Software for computer forensics}}

{{Infobox Software

| name = Forensic Toolkit

| logo = alt=FTK Logo

| screenshot =

| caption =

| developer = [http://exterro.com Exterro]

| released =

| latest release version = 8.0 SP2

| latest release date =

| operating system = Windows

| language = English

| genre = Digital forensics

| website = {{url|https://www.exterro.com/forensic-toolkit}}

}}

Forensic Toolkit, or FTK, is computer forensics software originally developed by AccessData, and now owned and actively developed by Exterro. It scans a hard drive looking for various information.{{cite web|url=http://archive.wired.com/politics/security/commentary/securitymatters/2007/01/72458?currentPage=all|title=Secure Passwords Keep You Safer|last=Schneier|authorlink=Bruce Schneier|first=Bruce|date=2007-11-01|publisher=Wired|page=3|accessdate=2009-01-12}} It can, for example, potentially locate deleted emails{{cite journal|last=Dixon|first=Phillip D.|date=December 2005|title=An overview of computer forensics|journal=IEEE Potentials|publisher=IEEE|volume=24|issue=5|page=8|issn=0278-6648|url=http://www.phillipdixon.net/PDForensics.pdf|accessdate=2009-01-12|doi=10.1109/mp.2005.1594001|s2cid=25462454|archive-date=2016-03-03|archive-url=https://web.archive.org/web/20160303213205/http://www.phillipdixon.net/PDForensics.pdf|url-status=dead}} and scan a disk for text strings to use them as a password dictionary to crack encryption.{{cite journal|last=Casey|first=Eoghan|date=Fall 2002|title=Practical Approaches to Recovering Encrypted Digital Evidence|journal=International Journal of Digital Evidence|publisher=Economic Crime Institute, Utica College|location=Utica, New York|volume=1|issue=3|page=12|issn=1938-0917|url=http://www.digital4nzics.com/Student%20Library/Practical%20Approaches%20to%20Recovering%20Encrypted%20Digital%20Evidence.pdf|accessdate=2009-01-12|archive-url=https://web.archive.org/web/20131102054557/http://www.digital4nzics.com/Student%20Library/Practical%20Approaches%20to%20Recovering%20Encrypted%20Digital%20Evidence.pdf|archive-date=2013-11-02|url-status=dead}}

FTK is also associated with a standalone disk imaging program called FTK Imager. This tool saves an image of a hard disk in one file or in segments that may be later on reconstructed. It calculates MD5 and SHA1 hash values and can verify the integrity of the data imaged is consistent with the created forensic image. The forensic image can be saved in several formats, including DD/raw, E01, and AD1.{{Cite web|last=|first=|title=FTK Imager User Guide v4.3.0|url=https://ad-pdf.s3.amazonaws.com/Imager/4_3_0/FTKImager_UG.pdf|archive-url=https://web.archive.org/web/20210419150238/https://ad-pdf.s3.amazonaws.com/Imager/4_3_0/FTKImager_UG.pdf|archive-date=2021-04-19|access-date=2020-10-08|website=|publication-date=January 28, 2020|url-status=dead}}