Forensic Toolkit v1.70
Strengths: Good workhorse, with access to the industry's premier password recovery suite
Weaknesses: Documentation could be better, lacks some expected functionality
Verdict: A good second computer forensic tool, especially for Windows-heavy operations
AccessData is one of the venerable developers of computer forensic software. The company's biggest strength is that it is, and has been since its inception, the go-to supplier of password recovery tools. AccessData has packaged its complete tool set in one product called the Ultimate Toolkit. In addition to the Forensic Toolkit, referred to by forensic analysts simply as "FTK", the Ultimate Toolkit contains the full suite of password recovery tools, drive and media wipers, a registry viewer and other useful products.
Some of the tools interface nicely with FTK, giving it a lot of power. At its core, however, FTK is the same computer forensic tool it was last year and, while its biggest strength is its ability to take advantage of other AccessData tools, this product is pure computer forensics through and through. While its user interface is somewhat different from other products in its class, it still provides most of the same functions one would expect in a straightforward computer forensics tool.
FTK does not handle all of the types of media that we would expect. However, it is strong in Windows files systems and does handle Linux file systems. This puts it at a bit of a disadvantage when compared with products that can acquire and analyse more file system types. FTK reads the most common types of images including DD, EnCase and older versions of SafeBack among others.
The product is very easy to use if you are familiar with typical computer forensic tools. The Toolkit's terminology is consistent with the rest of the industry, a refreshing practice in a market that does not necessarily always use the same buzzwords from product to product.
Installation, like it that of its competitors, is quick and straightforward, and the tool is up and ready to go in no time.
The documentation could be stronger. It consists of a single perfect-bound book, but many of the topics we expected, such as a discussion of the file systems FTK supports (there is a list) were not present.
Support comes at an extra cost but, at £569, we find that the product's value for the money is good given that the functionality may be somewhat less than one would expect in certain situations.