Forensic Tool Kit v 1.70

AccessData has packaged its complete tool set in one product called the Ultimate Toolkit. In addition to the Forensic Tool Kit, referred to by forensic analysts simply as FTK, the Ultimate Toolkit contains the full suite of password recovery tools, drive and media wipers, a registry viewer and other useful products.

Some of the tools interface nicely with FTK giving it a lot of power. At its core, however, FTK is the same computer forensic tool that it was last year and, while its biggest strength is its ability to take advantage of other AccessData tools, this product is pure computer forensics. Although its user interface is somewhat different from other products in its class, it still provides most of the same functions one would expect in a straightforward computer forensics tool.

FTK does not handle all of the types of media we would expect. However, it is strong in Windows files systems and does handle Linux file systems. This puts it at a bit of a disadvantage when compared with products that can acquire and analyze more file system types. FTK reads the most common types of images, including DD, EnCase and older versions of SafeBack, among others.

The product is easy to use if you are familiar with typical computer forensic tools. In addition, its terminology is consistent with the rest of the industry, a refreshing practice in a market that does not necessarily always use the same buzzwords from product to product. Installation is quick and straightforward, and it is up and ready to go in no time.

The documentation could be stronger. It consists of a single perfect-bound book, but many of the topics we expected, such as a discussion of the file systems FTK supports were not present. Support is an extra cost item. At US$1,095, we find that its value for the money is good given that the functionality may be somewhat less than one would expect in certain situations.