top of page

FTK Imager


As discussed in Craig Ball's Electronic Discovery Workbook, FTK Imager can be downloaded here for free. FTK Imager is part of the Forensic Toolkit developed by AccessData. FTK Imager allows you to create an image of a hard drive in different segments that can later be reconstructed. It uses MD5 hash values to confirm that the data has been copied correctly.

FTK Imager has many functions, but one of its more helpful ones it the ability to generate a list of hash value. Just go to File . . . Add Evidence Item. Select the type as the 'Contents of a folder' and the files in the folder will be loaded up.

. . . then simply go to File . . . Export File Hash List and an Excel .csv file will be created showing the SHA1 and MD5 hash values of each file in the selected folder.


Sean O'Shea has more than 20 years of experience in the litigation support field with major law firms in New York and San Francisco.   He is an ACEDS Certified eDiscovery Specialist and a Relativity Certified Administrator.

The views expressed in this blog are those of the owner and do not reflect the views or opinions of the owner’s employer.

If you have a question or comment about this blog, please make a submission using the form to the right. 

Your details were sent successfully!

© 2015 by Sean O'Shea . Proudly created with Wix.com

bottom of page