FTK or FTK Imager

[L Snider]

Hi Everyone,

I know many people use FTK Imager, because it is free and does an okay job. Anyone use the full version (expensive) FTK? Would you recommend it? Why/Why not? Issues?

I asked a couple of years back, but just wanted to get an update on this one as I am looking at both.

Thanks in advance

Lisa

Lisa Snider

Archivist

[Seth Shaw]

Stanford and the British Library are the two I can think of off the top of my head who have the full version. I seem to recall hearing one or two others doing so as well, but I can't recall who it was.

--
You received this message because you are subscribed to the Google Groups "Digital Curation" group.
To unsubscribe from this group and stop receiving emails from it, send an email to digital-curati...@googlegroups.com.
To post to this group, send email to digital-...@googlegroups.com.
Visit this group at http://groups.google.com/group/digital-curation.
For more options, visit https://groups.google.com/d/optout.

[mgo...@stanford.edu]

All,

Stanford has a site license to the full version of FTK which runs roughly $3,000 for ten licenses + yearly SMS. It isn't a bad deal and we still use the FTK in our labs. We're starting to process our collections using both BitCurator and FTK and can see benefits and cons for each. 

FTK processing jobs are terribly processing intensive.  I just recently I ran 1 TB imaged drive against FTK and it took the better part of a day to index using a tricked out 2012 FRED DX. The benefit is that if you are doing collection assessment using FTK it licenses a suite of viewers that allow an archivist to view multiple legacy file types.  Our digital archivist loves this feature but as our BD collections grow I wonder how frequently we'll have this luxury.

BitCurator has now viewing functionality but it much faster at processing searches for sensitive data using Bulk extractor (a built in module of the software).  I also like the fact that there are aspects of the BitCurator suite that are growing to support archival functions.  For example, FTK is not designed to redact data.  This makes sense as it is a software product for forensic investigations.  This however misses a key archival use case.

Hope this late night reflection is useful.

Michael

[Mark A. Matienzo]

I think the other thing to note is that FTK and FTK Imager have two radically different sets of uses and functionality. FTK Imager is mostly just for disk imaging and quickly inspecting a disk image, and FTK itself is for undertaking detailed inspection, analysis, and reporting on those disk images.

Mark

--

Mark A. Matienzo <ma...@matienzo.org>

Director of Technology, Digital Public Library of America

--

[L Snider]

Hi Seth,

Thanks so much, appreciate it.  I seem to remember others too, but couldn't remember for the life of me!

Cheers

Lisa

[L Snider]

Hi Michael,

Perfect info, thanks! We tested out BitCurator last August and I wasn't keen on its treatment of some file types (video, audio, email, etc.). However, I know more work has gone into it, so I will have to play with it again.

I really like the viewer aspect of FTK, I believe it uses QuickView in it, as it is all right there-a huge plus.

BC can only look for some data to redact, I am hopeful they will put back the actual redaction itself-we need this!

That was great, really appreciate the information.

Cheers

Lisa

--