When it comes to forensics, speed is king and the latest release of FTK® Imager, version 4.3 is all about speed; cutting imaging time in half.The faster you preserve the data, the quicker analysis can begin. To achieve this speed increase, we optimized the method we use to preserve the forensic image. The imaged computer was in another building with a 10Gbps link between the imaged machine and the server. Below are the details:
System 1 where image was taken from physical drive:
HP® EliteDesk® 800
Windows® 10 Pro
Intel® Core™ i7-8700 CPU @3.20GHz
32 Gig RAM
477 GB SSD drive
System 2 where image was stored:
Dell Poweredge® R720
Windows Server 2016 Standard
Intel Xeon® CPU E5-2620 0 @2.00GHz
32 Gig RAM
4TB Dell PERC H710 SCSI Disk Device (RAID 0, 4 – 1TB 7200 HD)
The results are as follows:
FTK Imager version 4.2.x and earlier:
Compressed images: 2:21:00
Non-compressed images: 4:16:23
FTK Imager version 4.3.x and newer:
Compressed images: 1:03:41
Non-compressed images: 1:29:25
That is amazingly fast! But that’s not all … in addition to the speed improvements, with 4.3 you can also capture and view APFS images from Mac® hard drives. You only need one tool for all operating systems.
We asked Tom Angle, a forensic consultant for law enforcement, to do a beta test for us, so he conducted his own tests on Windows and Mac machines and was very impressed:
“I’ve used FTK Imager for nearly 20 years. Imager has always been a dependable imaging tool but the recent improvements in speed and APFS functionality is really outstanding. Great work AccessData!”
You can already do so much with FTK Imager. Now, you can do it faster.
To download FTK Imager 4.3, click here.
