Legal Technology News - E-Discovery and Compliance Blog

« Webinar: “The Enlightened Legal Hold” with Craig Ball and Brad Harris | Main | Arkfeld Treatise in 3rd Edition »

October 08, 2010

And Did I Mention It Was FREE? - FTK Imager 3.0

I'm incessantly flogging the notion that lawyers need to get back in touch with the evidence.  By that I mean, lawyers need ways to get a jump on the cost, delay and anxiety that characterizes e-discovery circa 2010 and secure quick, non-destructive access to the electronic evidence that will drive the direction and outcome of the dispute.  This is what that awful marketing buzz phrase "early case assessment" would mean, if it meant anything at all.

If lawyers could just take a quick look at some of the relevant stuff that key players hold; you know, sit down with correspondence and documents like we did in the old days--browse, as it were--then lawyers could start asking the right questions from the start.  And asking the right questions is a trial lawyer's most important contribution.

So, when a tool surfaces that helps lawyers get back in touch with the evidence, I look at it.  When it's free and fairly easy to use, I jump up and down waving my arms madly for all to see.  I'm in that latter mode for the latest release of AccessData's FTK Imager Ver. 3.0, available here.

I've long been a huge fan of FTK Imager as it's a free, flexible and effective forensic imaging tool that includes a handy hex viewer and supports file extraction and hash digest list generation. Plus, it's free.  But now, at no charge, the program includes pretty robust image mounting capabilities.  That means that anyone without special forensic tools and for no dinero can now access the common forensic image formats as easily as if the imaged drive were your own hard disk.  Best of all, the process is read only, so you can't accidentally mess up the evidence--no, not even the marvelous, malleable metadata.  Hey, did I mention that FTK Imager 3.0 is free?

The advantage offered by a tool that can mount forensic images is that it gives lawyers an immediate window into the evidence.  Imaging for preservation tends to be done promptly (at least when parties are on top of their obligations).  But, once the data is encapsulated in a forensic image format, it's no picnic to find ways to let lawyers gain access.  Until now, lawyers had to go through someone like me for data extraction or drive restoration or purchase pricey, complicated tools they wouldn't be comfortable using.

Now, aided by an easy-to-use, no cost tool, lawyers can point at a copy of a forensic image and see the evidence drive mounted as an local hard drive on their own machine.  The active data on the evidence drive is right there to be explored.  Okay, a horrible notion in, say, a child pornography case, but for most civil matters, an effective, fast and affordable way to get the lawyers going on the merits--not as a substitute for a sound e-discovery methodology but as a powerful, insightful adjunct.

Kudos and salutations to AccessData for adding more utility to an already splendid tool.  Gratitude and admiration for giving it away.


TrackBack URL for this entry:

Listed below are links to weblogs that reference And Did I Mention It Was FREE? - FTK Imager 3.0:


What, actually look at the evidence? Get your hands dirty in the digital mud by actually studying the ESI? And do this without first paying a vendor to convert it to TIFF so you can pretend like its paper.

Craig, you are so radical!

Now why do you have to convert it all to a forensic image first? I used to think it was just because we'd then have to use you and your kind to ever look at it, just like in the white coat IBM days of the sixties, now I'm not so sure. Free you say? Still, it ain't native.

This could be an enormous help in white collar criminal cases where defense counsel are routinely given such images made by the government and have to go thru the process Ralph describes. For the U.S. Defenders office this is often a prohibitive cost.
Nice job FTK!

The comments to this entry are closed.

Sign Up for the E-Discovery and Compliance Newsletter

An Affiliate of the Network

From the Newswire

Sign up to receive Legal Blog Watch by email
View a Sample

Contact EDD Update

Subscribe to this blog's feed

RSS Feed: LTN Podcast

Monica Bay's Law Technology Now Podcasts are also available as an RSS feed.

Go to RSS Subscribe page

March 2013

Sun Mon Tue Wed Thu Fri Sat
          1 2
3 4 5 6 7 8 9
10 11 12 13 14 15 16
17 18 19 20 21 22 23
24 25 26 27 28 29 30

Blog Directory - Blogged