Forensic Toolkit (FTK) by AccessData

Yes, FTK can analyze encrypted drives, but you must either have the password, a recovery key, or a memory dump that contains the encryption keys. AccessData's separate FTK Imager tool is commonly used to capture the live memory of a target machine to extract these keys. Once the keys are recovered, the full Forensic Toolkit can process and decrypt the evidence.

FTK fully supports Apple file systems, including HFS, HFS+, and APFS, allowing investigators to process Mac and iOS evidence. The toolkit parses these specific file structures to extract deep artifacts like text messages, call logs, and third-party application data. Exterro, the parent company of AccessData, continually updates its mobile and Apple device support.

FTK utilizes a distributed processing architecture that allows examiners to use multiple compute nodes and dedicate specific CPU cores to evidence processing tasks. This database-driven approach heavily indexes files and creates a searchable backend, typically using PostgreSQL. This design prevents the software from crashing or stalling when handling terabytes of forensic data.

FTK is the full, paid investigative suite used for deep-dive forensic analysis and evidence processing. Conversely, FTK Imager is a free, standalone data preview and imaging tool provided by Exterro. Investigators use FTK Imager to create forensic copies of hard drives and capture memory before loading the evidence into the main Forensic Toolkit.