FORENSIC TOOLKIT (FTK)®

• Export your data into a portable case for offline review in QView. No need to spend time generating reports that can only be viewed in a couple of different formats. Portable case makes your life easier with a quick export. Reviewers will appreciate the ability to view the data in a near native format.
• Get a head start on your investigation with URL detection and parsing capabilities across devices without regard to browser, neatly organized under one section to easily review the data and connect the dots in your investigation.
• FTK will ingest and support updated versions of LX01 and E01 images.
• Automatically import and expand a nested forensic image with image within an image support.
• Import and parse AFF4 images created from Mac® computers (generated by third-party solutions like MacQuisition by BlackBag).
  
• Parse XFS file systems when investigating and collecting from RHEL Linux environments.
• Leverage the power of your forensic environment with optimized support for unified database for the AWS/Amazon RDS configuration. Host your FTK database in AWS to upload, process and review for unmatched speed and scalability.
• Cut down on OCR time by up to 30% with our efficient OCR engine.
• Locate, manage, and filter mobile data more easily with a dedicated mobile tab. Use the message application filter to quickly isolate data from message applications like WhatsApp or Facebook.
• View all associated EXIF data, including location, make and model of the device used to capture the images or video.
• Collect, process and analyze datasets containing Apple file systems that are encrypted, compressed or deleted.
• Decrypt a computer drive encrypted by the latest version of McAfee Drive Encryption and new L01 export support which eases the workflow of users when data must be used within multiple tools.
• Custom processing options help establish enterprise-wide processing standards, creating consistency for your investigations and reducing the possibility of missed data.
• The easy-to-use GUI provides a faster learning experience.
  
• Visualization technology that displays your data in timelines, cluster graphs, pie charts, geolocation and more, helps you get a clearer picture of events.

ADD ON THESE FEATURES TO ENHANCE THE POWER OF FTK

AccessData has developed other industry-leading solutions to assist in password recovery. These solutions are used in many different environments to provide specific, password-cracking related functions. Law enforcement and corporate security professionals performing computer forensic investigations, utilize these solutions to access password-protected files. Likewise, administrators can also utilize these solutions to recover system passwords, lost personal passwords and more. AccessData’s Password Recovery Toolkit® (PRTK®) and Distributed Network Attack® (DNA®) provide access to passwords for a large number of popular software applications. PRTK runs on a single machine only. DNA uses multiple machines across the network or across the world to conduct key space and dictionary attacks.

Rainbow (Hash) Tables

Rainbow Tables are pre-computed, brute-force attacks. In cryptography, a brute-force attack is an attempt to recover a cryptographic key or password by trying every possible key combination until the correct one is found. How quickly this can be done depends on the size of the key, and the computing resources applied. A system set at 40-bit encryption has one trillion keys available. A brute-force attack of 500,000 keys per second would take approximately 25 days to exhaust the key space combinations using a single 3 GHz Pentium 4 computer. With a Rainbow Table, because all possible keys in the 40-bit keyspace are already calculated, file keys are found in a matter of seconds to minutes; far faster than by other means. DNA and PRTK seamlessly integrate with Rainbow Tables.

Portable Office Rainbow Tables (PORT)

AccessData Portable Office Rainbow Tables (PORT) are different from the full Hash tables set. A statistical analysis is done on the file itself to determine the available keys. This takes far less space than the Hash Tables, but also takes somewhat more time and costs a small percentage in accuracy.

Let’s Get Started

FTK leverages multi-machine processing capabilities, cutting case processing times more than 400% vs. leading competitors, reducing case backlog significantly; it performs comprehensive processing upfront greatly increasing the speed with which an examiner can focus on the actual investigation.