Imager Pro

The FTK Imager menu bands do not adopt the scaling options from Windows. Even on 4k monitors, the menus remain small, making it difficult to work with. It would be desirable to adjust the scaling of the menu bands.

The imager currently only supports MD5 and SHA-1 hashes. Because of the legacy of the procedures, an implementation for SHA-256 would be desirable when building.

FTK Imager does not run in WinFE due to driver dependencies. Need a Lite or CLI version that can run in WinFE 64 bit. The use case is for imaging a machine from a bootable USB with WinFE. This is needed for a true forensic image of a machine as booting Windows creates, deletes, or changes anywhere from 1,000 to over 15,000 files by the time you reach the desktop. Current workaround is ewfaquire CLI tool.

Requesting functionality in Exterro similar to the File Class filter available in Microsoft Purview. Currently, Purview allows users to filter and separately select: Emails Conversations Documents Attachments This filtering capability is not currently available in Exterro and would improve search efficiency and review workflows for investigators and legal users. The team has previously discussed this enhancement and would like Exterro to evaluate adding comparable functionality.

Only certain FTK Imager functions require local administrator access. FTK Imager Pro needs the option to launch as a non-administrator user. While running in non-administrator mode, if I click on a function that requires administrator level permissions, then the application should prompt whether I would like to re-launch the application in administrator mode. (Similar to Notepad ++ and TreeSize)

Currently, there appears to be no way to search across the Key Custodian designation across the system. It would be helpful to have this value be able to be searched or filtered upon to quickly see who is considered a Key Custodian across the tool.

We would like to have the ability to limit emails from Exterro to only a handful of preset domains. This would assist in limiting inadvertent emails to non-company specific email domains.

Please add the functionality to export/dump the processed data via REST API into Python dictionaries. This data will be utilized for analysis within our AI engine as part of subsequent analytical processes.

As forensic images are created that will be segmented, those segments are recorded on the TXT log; however, they aren’t individually and independently hashed. Transportation and transfer of these segmented images can’t be verified independently and require the full image be loaded into Imager Pro for “verification.” Should just ONE segment file be corrupted in the transfer, users wouldn’t know which one to resend. It would be optimal for individual hashed segments referenced in the log so only those corrupted few could be retransmitted.