Exterro FTK

Full disk forensic images

Create full disk forensic images and process a wide range of data types from many sources, from hard drive data to mobile devices, network data, and Internet storage, all in a secure, centralized database. FTK® processes and indexes data in advance, eliminating wasted time waiting for searches to run. Reduce OCR time by up to 30% with our efficient OCR engine.

Decrypt files and crack passwords

Decrypt files, crack passwords, and create reports with a single solution. Recover passwords from more than 100 applications. Decrypt an encrypted computer drive with the latest version of McAfee Drive Encryption and features L01 export support, which facilitates user workflows when data must be used with multiple tools.

Analyze registry files

Analyze registry files and Windows system information files in an easy-to-read, interactive, and actionable tab. Tag, mark, and export individual objects by category, making them easy to search, filter, and report.

Locate, manage, and filter mobile data

Locate, manage, and filter mobile data more easily with a dedicated mobile tab. Use the messaging app filter to quickly isolate data from messaging apps like WhatsApp or Facebook.

Collect, process, and analyze data sets containing Apple file systems

Collect, process, and analyze data sets containing Apple file systems that are encrypted, compressed, or deleted. FTK® supports decryption of File Vault 2 from the APFS file system, as well as the import and analysis of AFF4 images created from Mac® computers (generated by third-party solutions such as MacQuisition by BlackBag).

Visualization technology

Visualization technology that helps you get a clearer picture of events by displaying your data in timelines, cluster graphs, pie charts, geolocations, and more. Drill down and view all EXIF data, including the location, brand, and model of the device used to capture images or videos.