DFFAD - Exterro FTK 101
Register Now


Forensic Toolkit 101 is a four-day course that will introduce the student to AccessData’s Forensic Toolkit (FTK) and the many features that aid the investigator in solving a wide variety of cases effectively. Over the four-day course students will get hands on time with each of the features within FTK. This course is designed for both new users to forensics, or those with years of forensic experience. While this course will use forensic artifacts to demonstrate the features, the focus of FTK 101 is to really teach the features and processes available to the investigator.


This course combines the one-day Digital Forensics with FRED and the four-day of FTK 101.  Additional tools covered and used in class are FTK ImagerTM, Password Recovery Toolkit (PRTKTM), and Registry ViewerTM.

Participants will use Exterro products to conduct forensic investigations on Microsoft® Windows® systems, learning where and how to locate Windows system   artifacts.

Upon course completion, attendees should be able to:

  • Install Exterro software tools
  • Create a case, process and analyze documents, metadata, graphics, and e-mails using FTK
  • Use bookmarks / check marks to efficiently manage and process a case
  • Update / customize the KFF database
  • Manage evidence using file filters
  • Perform searches using regular expressions and imported search lists
  • Carve unallocated disk space
  • Create and customize reports
  • Gain practical experience with FTK indexing
  • Create custom dictionaries using the FTK indexing
  • Create regular expressions
  • Use Registry Viewer to locate evidentiary information in Windows
  • Integrate Registry Viewer with FTK
  • Recover forensic information from Recycle Bin
  • Recovery forensic information from various Windows artifacts


This hands-on class is intended for new users, particularly forensic professionals and law enforcement personnel, who use Exterro/AccessData forensic software to examine,   analyze and classify digital evidence.

To obtain the maximum benefit from this class, you should meet the following requirements:

  • Read and understand the English language
  • Perform basic operations on a personal computer
  • Have basic knowledge of computer forensic investigations and acquisition procedures
  • Be familiar with the Microsoft Windows environment


Downloadable course syllabus


No classes scheduled at this time.

Questions? Would you like to learn more?