Archive for October, 2010

FTK Imager 3.0 released

Saturday, October 9th, 2010

FTK Imager 3.0 was released this week and is available for download. It’s free (as in beer) and it has a simple function to mount a forensic image as if it were a hard drive (read only by default) as well as support for a few more file systems such as exFAT and ext4fs. The FS support is also included in the simultaneous FTK 3.2 release (which is not free) which is particularly interesting, since last I knew, major competitor EnCase by Guidance doesn’t support ext4fs [PDF] – however X-Ways Forensic does.

Some bugs in the mounting feature have been reported and are being worked on according to AccessData’s support forums. However I tested the feature with 3 forensic images that I made for testing, and it worked perfectly on all 3. The mount process was quick and simple. There are of course numerous other solutions for mounting disk images, however I’ve tended to find them to be either onerous, limited, or non-free. This little feature will be great for scanning an image file with AV, or for making data available to 3rd party software that doesn’t have forensic file support.