The 3.4.0.1 release specifically stabilized several memory acquisition routines and enhanced support for various file systems, making it a reliable choice for standalone forensic workstations and USB triage kits. Core Features and Capabilities
Set level (0 for none, 9 for maximum; 6 is standard balance).
While version 3.4.0.1 is a "classic" version frequently cited in academic papers and lab manuals from around 2015–2020, the tool has since been updated.
FTK Imager 3.4.0.1 is a lightweight, commercial-grade data preview and imaging tool. It allows forensic professionals to examine files and folders on various media types—such as hard drives, flash drives, and network shares—and create exact forensic copies of that data. ftk imager 3.4.0.1
Always log the MD5 and SHA-1 hashes generated in the final .txt report for your chain of custody documentation.
Click Add to set up the output file. You will select the image type (E01 is generally recommended). Next, provide case details such as:
To prove in court that an image has not been altered, FTK Imager automatically generates and SHA1 hash values for the original media. It then hashes the newly created image file and compares the two. If the hashes match, the evidence is mathematically proven to be a perfect copy. Advanced File System Support FTK Imager 3
Displays the contents of a selected file. It features tabs for Hex View (to examine raw binary structures), Text View (to scan for readable strings), and Natural View (rendering images, documents, or HTML as the user would normally see them).
Set the . The default is 1500 MB, which splits the image into smaller, manageable chunks. Set this to 0 if you prefer a single, unfragmented file.
An older forensic format used primarily in Linux-based forensic tools. Click Add to set up the output file
The standard Guidance Software format which includes embedded metadata, case data, and compression.
FTK Imager 3.4.0.1 is a free, data preview and imaging tool that allows investigators to examine files and folders on target storage media without altering the original evidence.
to verify the integrity of the captured image against the source. Mounting Capabilities:
File → Capture Memory