Hands-On: Exploring Evidence with FTK Imager
Where you are: Part II — The Technical Foundations · Lesson 2.6 · This lesson follows Chapter 2.6 of Dr. Al-Doori's IT Forensics Essentials: exploring the software, FTK Imager.
Ethical scope: this hands-on activity uses only a spare USB stick that you own and that holds only test files you created for the purpose. Only examine devices, accounts and systems you own or are explicitly authorized to work with. Never image a drive that belongs to someone else, your employer's equipment, or your computer's own system drive.
What you'll be able to do
By the end of this lesson you will be able to find your way around a real forensic imaging tool and create a verified image.
- Name the panes of FTK Imager and what each one shows.
- Add an evidence item, create a disk image and verify it with hash values.
- Explain why a practice image of your own USB stick is not the same as handling real evidence.
Why FTK Imager?
Dr. Al-Doori chose FTK Imager for the book's hands-on work for two reasons. It is a powerful product that demonstrates a great deal about computer forensics and imaging, and it is free to download, so every reader can use it. It is a Windows program, now published by Exterro. The download is free but asks you to complete a short form.
A Tour of the Screen
FTK Imager's window has a menu bar and several panes that work together.
+-----------------------------------+
| File View Mode Help |
+-----------------+-----------------+
| Evidence Tree | File List |
| (the image's | (contents of |
| folders) | the folder) |
+-----------------+-----------------+
| Properties / | Viewer |
| Hex Value | (the chosen |
| Interpreter / | file as text, |
| Custom Content | picture or |
| Sources (tabs) | hex) |
+-----------------+-----------------+
The sketch above is a simplified outline of the usual layout, not a screenshot. You can move the panes, and your version may look slightly different.
The menus. The File menu is where most work starts: adding evidence, mounting images and creating disk images. The View menu shows or hides panes and changes icon sizes. The Mode menu controls how the viewer displays a file: as hex, as text, or automatically according to the file type. The Help menu opens the user guide.
The panes. With an image loaded, the panes are linked:
- Evidence Tree. The contents of the drive as a hierarchy of folders that you expand and collapse with the plus and minus signs.
- File List. The details of whatever folder is highlighted in the Evidence Tree: its files and subfolders.
- The combination pane. Three tabs. Properties shows metadata about the selected item: file-system details at the partition level, file properties at the file level. The Hex Value Interpreter translates the hex you highlight into values such as dates and times. Custom Content Sources lists the items the user has chosen for a custom content image.
- Viewer. Shows the selected file, as a picture or text or as raw hexadecimal, according to the Mode setting. You can select bytes in the hex and examine them, using what you learned in Lesson 2.2.
Try It: Image Your Own USB Stick (Optional)
You need a Windows computer you own, FTK Imager from the official Exterro website, a spare USB stick with a few test files you created, and enough free space for an image the size of the stick.
Prepare the stick. Copy three harmless test files onto it, for example a short text file, a photo of a houseplant and a small spreadsheet. Then delete one of them. You will look for it later.
Create the image.
- Start FTK Imager (Windows may ask for administrator permission).
- From the File menu choose Create Disk Image, then Physical Drive, and select your USB stick. Check the size and model carefully so that you pick the right drive.
- Add a destination and choose an image type. Raw (dd) produces a plain copy; E01 stores the data with case details and hash values built in.
- Fill in the evidence information: a case number of your own invention, an evidence number and a short description.
- Make sure the option to verify the image after it is created is ticked, then start.
Check the verification. When imaging finishes, FTK Imager shows the hash values it calculated for the source and for the image, and whether they match. Write them down, with the date and time, in a simple evidence log.
Explore the image. From the File menu choose Add Evidence Item, then Image File, and open your image. Expand the Evidence Tree. Find your test files, look at one in the Viewer as hex, and check its Properties. Then look for the file you deleted: deleted items that are still recoverable are typically shown with a red X. Notice that you can see it even though Windows no longer shows it on the stick.
Reading-only alternative. If you cannot run FTK Imager, read through the steps and the panes above, and watch the video in this lesson. You will also work with supplied tool outputs in Capstone A.
Your Practice Image Is Not Real Evidence
Two honest caveats. First, you connected your own USB stick straight to Windows. With real evidence, a write-blocker would sit between the device and the computer so that nothing could be written to it (Lesson 4.2). Windows sometimes writes small changes to drives it mounts, which is one reason your before and after hashes of the stick itself might not always match. Second, a real acquisition is documented in full: who, when, where, which tool and version, and the chain of custody from Lesson 1.4.
Real-World Example
Imagine (a fictional scenario) a university IT team that receives a USB stick that a student found left in a lab printer and handed in. Before anyone opens it, the team's trained examiner images it through a write-blocker with FTK Imager, records the hashes and logs the item. Exploring the image, she finds a coursework file and an ID card scan, enough to identify the owner, without ever plugging the stick into an ordinary computer or opening anything beyond what was needed. The stick is returned, and the log shows exactly what was done and why.
From the Book to 2026
What the book teaches. FTK Imager is a powerful, free tool for creating, mounting and exploring disk images, downloadable from the AccessData/Exterro website or reputable software archives.
Why it made sense. It was, and is, one of the most widely used free imaging tools and an excellent way to learn.
What has changed. AccessData's forensic products are now Exterro's, and FTK Imager is still free from Exterro's website. In 2025 Exterro also launched FTK Imager Pro, a paid upgrade that adds triage and decryption features. Two cautions apply to the book's advice. Download forensic tools only from the publisher's official site, not from third-party archives, which can host altered copies. And verify your tool versions, because results should be reproducible with the same version.
What to do now. Get FTK Imager only from Exterro, record its version in your notes, keep verification switched on, and use a write-blocker for anything that is real evidence.
Watch: Forensic Acquisition in Windows with FTK Imager
This DFIRScience video, from a channel run by a digital forensics academic, demonstrates acquiring a disk image in Windows with FTK Imager.
Questions to keep in mind as you watch:
- Which source type and image format does the presenter choose, and why?
- Where in the process are the hash values calculated and checked?
- What precautions are taken to protect the source, and how do they compare with this lesson's caveats?
The video complements what you just read. The lesson is complete without it.
What Would You Do?
After imaging a practice USB stick, FTK Imager reports that the verification hashes match. Your friend says: "Great, so now the image proves who put those files on the stick." Is your friend right? Decide, then compare with the model answer in the note below.
Knowledge Check
Which FTK Imager pane shows the contents of the drive as an expandable hierarchy of folders?
In FTK Imager, which menu do you use to create a disk image and to add an evidence item?
Why should a real suspect's USB stick be connected through a write-blocker rather than plugged straight into a workstation?
Answers explained
- Question 1: c. The Evidence Tree shows the drive's structure. The Viewer (a) displays the selected file, and the Hex Value Interpreter (b) translates highlighted bytes.
- Question 2: a. The File menu holds Add Evidence Item, Image Mounting and Create Disk Image. View (b) controls panes, and Mode (c) controls how the viewer displays files.
- Question 3: b. Operating systems can write to drives they mount, changing the evidence. Write-blockers do not mainly speed things up (a), FTK Imager runs without one (c), and they do not encrypt (d).
On "What Would You Do?": No. Matching hashes prove that the image is an exact copy of the stick at the time of imaging. They say nothing about who created or copied the files. That needs other evidence, such as file metadata, USB connection records on a computer, or witness statements, all interpreted carefully.
Key Takeaways
- FTK Imager is a free Windows imaging and preview tool, now published by Exterro.
- Its panes work together: Evidence Tree, File List, Properties, Hex Value Interpreter, Custom Content Sources and Viewer.
- Create images with verification on, record the hashes, and explore the image rather than the original.
- Practice only on your own spare USB stick. Real evidence needs a write-blocker and full documentation.
Sources
- Dr. Tahseen Al-Doori — IT Forensics Essentials: Concepts, Tools, and the Practice of Digital Investigation, Chapter 2.6
- Exterro — FTK Imager
- Exterro — Introducing Exterro FTK Imager Pro: Faster, Smarter, and Built for Today's Investigations (September 2025)
- Exterro — FTK downloads
- NIST — Computer Forensics Tool Testing Program (CFTT)
- NIST — SP 800-86: Guide to Integrating Forensic Techniques into Incident Response