FTK Imager 3.0 (new version)

On October 8, 2010 new version of FTK Imager by Accessdata was published. FTK imager always has been  good and useful free forensic software. It’s main application was live forensic (live ram and hard drive acquisition). Second application was a free tool to mount E01 images to perform simple triage without using more advanced (and high price) tools such as Encase, FTK or X-Ways.

Since now FTK imager can be used in new useful way during forensic investigations.  It can  mount a forensic Image (AFF/DD/RAW/001/E01/S01) as a physical device or logically as a drive letter. Once mounted we can freely use 3rd party applications like Antivirus software (all standard computer forensic investigations should include Virus/Trojan search on acquired data), or carving and data recovery tools (I strongly recommend R-Studio it is the Best and many times helped me to recover files that any other data recovery program couldn’t)

FTK Imager can be also use as a snapshot/RAM acquisition utility. In 3.0 version RAM acquiring is really easy you only have to click Capture Memory icon. Unfortunately only install version is available but after installing it in any computer you can copy program folder to pen drive and then you have tool for live forensic. You can download FTK Imager 3.0 from Accessdata