For training and testing
Imaging
Click File > Create Disk Image . Choose Physical Drive (recommended for full recovery) and click Next .
What are you attempting to image (e.g., internal SSD, encrypted drive, network share)?
This version supports a wide range of file systems, including but not limited to: ftk imager 3.4.0.1
Select the source drive from the drop-down menu and click .
Launch FTK Imager 3.4.0.1 (run as Administrator to ensure full hardware access). Click on > Add Evidence Item .
:
For a specialized and portable workflow, you can create a "Lite" version by copying the installation folder from C:\Program Files\AccessData\FTK Imager onto a USB drive. This allows you to run the tool on a target system without a full installation, which is extremely useful for first responders. For training and testing Imaging Click File >
Browse the Windows Registry hives ( SAM , SOFTWARE , SYSTEM , SECURITY , NTUSER.DAT ) directly from the image or a live system. Step-by-Step Workflow: Creating a Forensic Image
FTK Imager 3.4.0.1 is not a full analysis suite like EnCase or X-Ways, but it excels at its specific mission: acquiring and previewing evidence. Here are its flagship features:
This article explores every facet of FTK Imager 3.4.0.1—its core features, installation, practical use cases, forensic soundness, and how it compares to newer versions.
FTK Imager is a free, standalone forensic imaging and data preview tool developed by AccessData (now part of Exterro). Version 3.4.0.1, released during a transitional period for the software, represents a stable build that balances performance with essential forensic integrity. Unlike its bigger brother, the full Forensic Toolkit (FTK), Imager is —requiring no license key. This version supports a wide range of file
Run as Administrator: To ensure it has full access to drives, always right-click the FTK Imager shortcut and select "Run as administrator" . Use a Write Blocker: For true forensic integrity, connect the source drive via a hardware write blocker. This prevents the operating system from accidentally writing to the evidence drive.
In digital forensics and incident response (DFIR), preserving data integrity is the single most important step of an investigation. For years, AccessData’s (now Exterro) FTK Imager has been the industry-standard software for creating reliable, court-admissible digital copies of evidence. Version 3.4.0.1 remains a highly utilized, stable release in the toolkit of cybersecurity analysts, law enforcement officers, and IT auditors worldwide.
Using FTK Imager is quite intuitive. Here is a typical workflow for creating a forensic image: