Cut Your Imaging Time In Half With FTK® Imager 4.3

When it comes to forensics, speed is king and the latest release of FTK® Imager, version 4.3 is all about speed; cutting imaging time in half.The faster you preserve the data, the quicker analysis can begin. To achieve this speed increase, we optimized the method we use to preserve the forensic image. The imaged computer was in another building with a 10Gbps link between the imaged machine and the server. Below are the details:

System 1 where image was taken from physical drive:
HP® EliteDesk® 800
Windows® 10 Pro
Intel® Core™ i7-8700 CPU @3.20GHz
32 Gig RAM
477 GB SSD drive

System 2 where image was stored:
Dell Poweredge® R720
Windows Server 2016 Standard
Intel Xeon® CPU E5-2620 0 @2.00GHz
32 Gig RAM
4TB Dell PERC H710 SCSI Disk Device (RAID 0, 4 – 1TB 7200 HD)

The results are as follows:

FTK Imager version 4.2.x and earlier:
Compressed images: 2:21:00
Non-compressed images: 4:16:23

Get The Latest DFIR News

Join the Forensic Focus newsletter for the best DFIR articles in your inbox every month.

Unsubscribe any time. We respect your privacy - read our privacy policy.

FTK Imager version 4.3.x and newer:
Compressed images: 1:03:41
Non-compressed images: 1:29:25

That is amazingly fast! But that’s not all … in addition to the speed improvements, with 4.3 you can also capture and view APFS images from Mac® hard drives. You only need one tool for all operating systems.

We asked Tom Angle, a forensic consultant for law enforcement, to do a beta test for us, so he conducted his own tests on Windows and Mac machines and was very impressed:

“I’ve used FTK Imager for nearly 20 years. Imager has always been a dependable imaging tool but the recent improvements in speed and APFS functionality is really outstanding. Great work AccessData!”

You can already do so much with FTK Imager. Now, you can do it faster.

To download FTK Imager 4.3, click here.

Leave a Comment

Latest Videos

This error message is only visible to WordPress admins

Important: No API Key Entered.

Many features are not available without adding an API Key. Please go to the YouTube Feeds settings page to add an API key after following these instructions.

Latest Articles