: Capable of creating bit-for-bit forensic images of physical drives or specific logical volumes.
If you are on a running machine and need to see what is on a connected external drive or an internal volume without imaging it yet: ftk imager lite
Creates bit-for-bit copies of entire physical drives or specific logical partitions. : Capable of creating bit-for-bit forensic images of
The Lite version is particularly useful in "Live Response" scenarios. When a computer is powered on and suspected of being involved in a security breach, shutting it down can result in the loss of critical evidence stored in the RAM. By using FTK Imager Lite, an investigator can: When a computer is powered on and suspected
Hash specific files to check for tampering or known malware signatures.
As of 2025, FTK Imager Lite remains freely available from Exterro (which acquired AccessData). Always verify the hash of your downloaded executable against official sources to avoid tampered versions.