StorageDigital Storage ForensicsHDD ForensicsImage hard drives through a write-blocker, find hidden areas and recover deleted data.Exterro
Exterro FTK Forensic Toolkit
FTK is the Forensic Toolkit that AccessData built and Exterro has owned since late 2020. Today Exterro sells it as Exterro FTK in a standalone form and as FTK Central for teams, with FTK Imager alongside.
PlatformCommercialCurrentWindows
Profile
- Manufacturer
- Exterro
- Category
- Computer forensics
- Product type
- Platform
- Platforms
- Windows
- Licensing
- Commercial
- Product status
- Current
- Educational level
- Intermediate
- Last verified
- 2 November 2026
Exterro's product page uses the full name Exterro FTK Forensic Toolkit and the short form Exterro FTK. Its forensics overview on 2 November 2026 listed Exterro FTK (Standalone), Exterro FTK Central (Collaborative), FTK Imager and FTK Imager Pro, with FTK Connect, Remote Endpoint Collection and cloud connectors as FTK Central add-ons; FTK Lab and FTK Enterprise do not appear there. Exterro completed its purchase of AccessData in December 2020 and no later change of ownership was found. Armour for FTK was announced by Exterro on 9 July 2026. The Windows platform comes from the page's structured data.
What Exterro FTK Forensic Toolkit is
FTK's design choice has always been to process everything first. When an image is added, the tool expands archives, indexes text, hashes files, categorises them and builds a database, so that later searches and filters return in seconds. That makes it slow to start and fast to work in, which suits large cases. Exterro's page describes the current engine as one that ingests and processes evidence at enterprise scale with indexing, search, timeline and artefact analysis, plus review of Mac data, image identification, system summary parsing and export of a portable case for people without the software.
The names around the product have moved. AccessData sold FTK, FTK Lab and FTK Enterprise. Exterro bought AccessData in December 2020 and for a time kept those names in its 7.x releases. On 2 November 2026 Exterro's forensics page listed Exterro FTK (Standalone), Exterro FTK Central (Collaborative), FTK Imager, FTK Imager Pro and add-ons for FTK Central such as Remote Endpoint Collection, FTK Connect and cloud connectors, together with Armour for FTK, an agentic AI layer announced in July 2026. The names FTK Lab and FTK Enterprise no longer appear. No change of ownership in 2024 to 2026 was found; Exterro remains a private company backed by its existing investors.
Primary applications
Where it is used
- Processing and indexing large computer images so that keyword search and filtering are quick
- Reviewing email, documents and internet artefacts from a workstation image
- Team-based investigation through FTK Central where several reviewers share one case
- Exporting a portable case to investigators or counsel
- Integration with security tools through FTK Connect in enterprise settings
Who uses it
- Government and police laboratories with large case loads
- Corporate forensic and eDiscovery teams
- Examiners preparing for vendor or institute certification
- Students learning indexed search and case processing
Capabilities and limits
Major capabilities
- Evidence ingestion and processing with full-text indexing
- Search, timeline and artefact analysis across a processed case
- Mac data review, image identification and system summary parsing
- Portable case export for review without a licence
- Exterro FTK Central for collaborative, multi-user investigations
- Add-ons for remote endpoint collection, cloud and SaaS connectors and FTK Connect automation
- Exterro Intelligence and Armour for FTK as the maker's AI layers, announced in 2026
Technical limitations
- Up-front processing takes time and disk space; a lab must plan hardware for it
- The product family has been renamed more than once, so older training material and job descriptions may not match current names
- AI review and natural-language actions on live endpoints need validation before their output is relied on
- The page lists Windows in its structured data only; version requirements must be checked in Exterro's documentation
- FTK does not do device access for locked phones; mobile work depends on backups and extractions from other tools
Learning with DFRTI
Independent professional education covering the principles and workflows of Exterro FTK Forensic Toolkit. DFRTI is not a vendor training centre and its courses are not vendor certifications.
Before you learn it
- File systems and common Windows artefacts
- Hashing, known-file filtering and why processing options matter
- Keyword and regular expression search basics
Disciplines
Related tools
- Exterro FTK ImagerFTK Imager is the free tool most learners meet first. It makes forensic images of drives, folders and memory, verifies them with hashes and lets an examiner preview evidence before committing to a full acquisition.Exterro
- OpenText Forensic (EnCase)EnCase Forensic, one of the oldest names in computer forensics, is now called OpenText Forensic (EnCase). OpenText says it is the same product, renamed to fit its cybersecurity portfolio.OpenText
- X-Ways ForensicsX-Ways Forensics is the German examination tool that runs light, starts fast and gives the examiner the raw disk alongside the parsed view. Version 21.9 was current when this page was checked.X-Ways Software Technology AG
- Magnet AxiomAxiom is Magnet Forensics' main examination platform. It takes images and extractions from computers, phones, cloud accounts and vehicles into a single case and presents the artefacts side by side.Magnet Forensics
- AutopsyAutopsy is a free, open source examination platform that puts a graphical interface and ingest modules on top of The Sleuth Kit. For a student it is the first tool that shows a whole case from image to report at no cost.Sleuth Kit Labs
- Belkasoft X ForensicBelkasoft X is a single tool for computer, mobile, drone, vehicle and cloud evidence. Belkasoft sells X Forensic to government customers and X Corporate to businesses, both on a perpetual licence.Belkasoft
Courses that cover this tool
StorageDigital Storage ForensicsHDD ForensicsImage hard drives through a write-blocker, find hidden areas and recover deleted data.
StorageDigital Storage ForensicsFile System AnalysisRead NTFS, FAT, exFAT, ext4 and APFS at the structure level and build timelines.
LegalFoundation & Legal CoursesForensic Report WritingWrite clear forensic reports that answer the questions asked and survive cross-examination.
LegalFoundation & Legal CoursesBasics of Cyber ForensicsStart here. Evidence handling, imaging, hashing, chain of custody and your first analysis.Official source
Product names and trademarks belong to their respective owners. DFRTI is an independent educational and research institute. Inclusion in this directory does not imply manufacturer endorsement, partnership or authorisation. Facts are checked against the manufacturer's public documentation on the date shown and may have changed since.
Go deeper with DFRTI
Free pages explain the ground. Structured courses, lab work and a mentor take you from knowing about it to doing it on a case.