ftk imager.exe
by AccessData / Exterro
Forensics
Summary
FTK Imager — forensic disk imaging and evidence acquisition tool
ftk imager.exe is the 2382nd most commonly executed Windows program in EchoTrail's dataset, observed 192 times across enterprise environments. It typically runs from C:\Program Files\AccessData\FTK Imager and it is most often launched by explorer.exe.
2382nd
most commonly executed Windows program
192
observed executions
low
statistical confidence
Behavior
Top Paths
- C:\Program Files\AccessData\FTK Imager97.92%
- C:\...2.08%
Top Hashes (SHA256)
- 78545ade66294412bc5dc8c7a5583103a74ef0db7138b32abf53a7651e03530d50.27%
- 21a9724711aa40113d75d8613099a10cb186ab6a5a18bbc49d903de72d34055437.16%
- 20855060eea654a97f137320b0343c5e3765bece7ae22454d694cd63020e9e6d10.93%
- f0b2d42da422e062c7a40178f2da7c6b713bb2a6f9859480c77127016755eec71.09%
- c802344acf3ef8ccbda2f5103c721e23e81da3e8026858fe4c93cf380ba659630.55%
Process Ancestry
Top Grandparents
- userinit.exe66.67%
Top Parents
- explorer.exe96.32%
- msiexec.exe3.68%
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Ask Rocky about ftk imager.exe
Rocky answers questions about ftk imager.exe grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.