FTK Imager Alternatives for Disk Imaging and Triage

FTK Imager is Exterro's free tool for making forensic images of drives, removable media and RAM, and for previewing evidence before you commit to a full image. It is alive and maintained. The FTK downloads page lists FTK Imager 8.3 and 8.3.1, plus FTK Imager Pro 8.2 SP1. The product page calls it "Windows only" and adds that while Imager can image a Linux device, "it cannot be installed on a Linux device."

Two things send people looking. In September 2025 Exterro launched FTK Imager Pro, and the Pro page now lists iOS collection, encryption detection and BitLocker decryption as paid extras at $499 a year. And examiners on Linux or Mac workstations still have no native build. The picks below cover imaging from a Linux boot drive, imaging phones, cheap paid imaging, mounting images, triage collection, memory capture and analysis, in roughly that order of how often an FTK Imager user needs them.

Network tools such as Wireshark, Nmap and Xplico are not on this list, because they do not image disks. If your case is mainly phones for police or corporate investigations, our Cellebrite alternatives guide covers mobile extraction suites.

Prices below are as of November 8, 2026. Our method is on How we review tools.

Quick comparison

Guymager

On Linux, Guymager is the imager most examiners reach for. The project site describes it as free and completely open source, and says it writes flat dd, EWF (E01) and AFF images and can also clone disks. Its pipeline and its compression are both multi-threaded, so it keeps every core busy on a multi-processor box.

It fills the hole FTK Imager leaves on Linux boot media. On Debian or Ubuntu it installs with apt-get install guymager from the universe repository. The site also runs its own APT server with a guymager-beta package, which it calls stable but not yet shipped by the distributions, for anyone who wants the newest build.

Best for: Examiners who boot suspect machines from Linux media and want E01 or AFF output from a graphical tool.

Pricing:

• Free and open source

Watch out for:

• It runs under Linux only, per the project site. A Windows lab needs a Linux boot drive or VM to use it.
• Its feature list covers media acquisition and cloning. RAM capture is not on it, so carry a memory tool as well.

Official site: Guymager.

Magnet Acquire

Magnet Forensics, the company behind AXIOM, gives this imager away. The product page says it makes forensic images of iOS and Android devices as well as hard drives and removable media, and that it is "free for members of the forensics community." You request a copy through a form, and existing customers download it from the Customer Portal.

Phones get two modes. Quick extraction works on all iOS and Android devices. Full extraction needs a rooted Android phone for a physical image, or a jailbroken iPhone for a file system logical image. Magnet's free tools page adds that Acquire can run from external storage, which helps when you have to image a machine where it sits.

Best for: Investigators who image both computers and phones they can open and want one free tool for both jobs.

Pricing:

• Free for members of the forensics community, request form required

Watch out for:

• Phone imaging depends on access. The free tools page says it images iOS and Android devices "if the passcode is known." Locked phones need a full mobile suite.
• The product page lists no supported operating systems, image formats or version number. Test a download before you build a workflow on it.

Official site: Magnet Acquire.

X-Ways Imager

Take X-Ways Forensics, grey out almost everything except acquisition, and you have X-Ways Imager. The Imager page says it creates raw images or .e01 evidence files, shares the compression algorithms of the full suite, and is fully portable, so it can run from a USB device without installation.

It is the cheapest paid imager in this list. The order page prices 1-year and 2-year licences at $90.90 each for 2 or more copies and perpetual licences at $193.90 each for 2 or more. On the same page, full X-Ways Forensics starts at $1,560 non-perpetual and $4,035 perpetual, with updates until November 2027. X-Ways Forensics 21.9 runs on Windows 7 to 11 and Windows Server up to 2025, per its product page.

Best for: Labs that want a supported, portable Windows imager with tunable E01 compression on a small budget.

Pricing:

• Non-perpetual, 1 or 2 years: $90.90 per licence at 2+, $80.90 at 5+, $71.90 at 10+
• Perpetual: $193.90 per licence at 2+, $154.90 at 5+, $141.90 at 10+
• Updates included until Nov 2027; longer update periods cost 29% or 66% more
• Prices in USD; VAT or sales tax may apply

Watch out for:

• There is no free tier, so it costs money for a job FTK Imager does at no charge. The order page shows volume tiers from 2 copies; the single-copy price is set in the order form.
• The Imager page says it cannot create evidence file containers, skeleton images or cleansed images, and it cannot leave excluded files out of a disk image.

Official site: X-Ways Imager.

Arsenal Image Mounter

Arsenal Image Mounter is for the step after acquisition. The product page says it mounts the contents of disk images as complete disks in Windows, so other tools treat the image like an attached drive. Free Mode includes temporary write support, identifying BitLocker volumes and opening them, RAM disks, and command-line and PowerShell tools.

Free Mode can also save physically mounted objects to various disk image formats, which is handy for converting a format another tool will not read. Professional Mode adds launching virtual machines from an image, bypasses for Windows authentication, DPAPI and S Mode, writing images back to physical disks, and saving images with fully decrypted BitLocker volumes.

Best for: Examiners who need to browse or boot an image as a real disk on a Windows workstation.

Pricing:

• Free Mode: free
• Professional Mode: $907 for 1 year, $2,448 for 3 years, $3,840 for 5 years (USD, excluding tax)

Watch out for:

• It is a Windows tool. The product page describes mounting in Windows only.
• Launching a virtual machine from an image is a Professional Mode feature, so that workflow starts at $907 a year.

Official site: Arsenal Image Mounter.

KAPE

Kroll Artifact Parser and Extractor, written by Eric Zimmerman at Kroll, skips the full disk image. It copies forensically useful files from a live system or a mounted image within minutes, then runs programs over what it collected. The Kroll page counts over 60 predefined targets, which are sets of file and folder specs, and 90 modules, which run programs, and you can write your own of each.

It pairs well with the mounter above. Mount an E01 with Arsenal Image Mounter and KAPE can treat it like a live drive. The download arrives by email as a .zip file containing KAPE.exe and the end user licence agreement.

Best for: In-house and government responders who need registry hives, event logs and similar artifacts quickly rather than a whole image.

Pricing:

• Free under the Kroll EULA for law enforcement, personal non-commercial use, education and research, and internal non-revenue use
• Commercial use needs a separate agreement with Kroll; no public price

Watch out for:

• Consultants should read the EULA first. It bars use "in furtherance of any commercial or revenue-generating activity" and excludes revenue-generating professional services from permitted use.
• Targets are lists of files and folders, not a sector-level copy, so unallocated space and slack stay behind.

Official site: KAPE.

Magnet RAM Capture

FTK Imager's memory capture is one reason it lives on so many response USB sticks. Magnet RAM Capture does that one job for free. Magnet's free tools page says it acquires the physical memory of a Windows computer and has a command-line mode for a smaller footprint on the system.

For newer hardware, Magnet also gives away DumpIt. The DumpIt announcement from January 12, 2023 says the Windows version supports x86, x64 and ARM64 and writes full Microsoft crash dumps. DumpIt for Linux is open source, written in Rust, reads /proc/kcore, and can write a zst-compressed archive.

Best for: Responders who need a free RAM dump from a running Windows machine before it is shut down.

Pricing:

• Magnet RAM Capture: free
• DumpIt for Windows: free
• DumpIt for Linux: free and open source on GitHub

Watch out for:

• RAM Capture covers Windows only. Linux hosts need DumpIt for Linux instead.
• The announcement describes DumpIt for Windows output as crash dumps. Confirm your memory analysis tool reads that format before an incident, not during one.

Official site: Magnet RAM Capture. Our listing: Magnet RAM Capture.

dcfldd

dcfldd is GNU dd modified for forensic work. The README lists what it adds: hashing while data is copied, verifying that a target is a bit-for-bit match of the source, progress output with time remaining, more configurable split output, and several outputs at once. The repository carries a GPL-2.0 licence.

Updates are small but regular. The releases page shows version 1.9 adding a diffwr option that writes only when the destination content differs, and 1.9.3 fixing the build with GCC 15. Because it is a single command, it fits scripts, SSH sessions and headless servers where a GUI imager cannot run. A Debian package is available through apt.

Best for: Scripted imaging over SSH or on headless Linux machines where a graphical imager is not an option.

Pricing:

• Free and open source (GPL-2.0)

Watch out for:

• The README describes output to files or disks and never mentions E01. Plan for raw images and the disk space they take.
• The README says the original homepage and developers are inactive. It is now maintained by volunteers.

Official site: dcfldd.

Autopsy

Once the image exists, Autopsy is the free way to open and search it. It is the graphical analysis platform built on The Sleuth Kit. The download page lists Autopsy 4.23.1 with a 64-bit MSI installer for Windows and a ZIP for Linux and macOS, where you also install The Sleuth Kit Java package 4.14.0.

The release notes for 4.23.0, out in April 2026, added an MCP over STDIO server on Windows, a signed EXE and thumbnail extraction. They also switched keyword and email regex search off during ingest by default because it was slow. Version 4.23.1 followed on May 7 to fix a release that had shipped as a develop build.

Best for: Students and small labs who want to search the E01 they just made without paying for a commercial suite.

Pricing:

• Free and open source

Watch out for:

• The 4.23.0 release notes warn of significant slowdowns when an EDR monitors the case folders and disk images. Exclude those folders from scanning.
• Linux and macOS get no installer. The download page says to unpack the ZIP and install the dependencies by hand.

Official site: Autopsy. Our listing: Autopsy.

How to choose

When to stay with FTK Imager

Keep FTK Imager if you work on Windows and want one free program that images drives, captures RAM and previews evidence. No single free pick above does all three: Guymager and dcfldd only image, Magnet RAM Capture only dumps memory, and Autopsy only analyses. If BitLocker is your main problem, FTK Imager Pro at $499 a year is cheaper than Arsenal's Professional Mode at $907 for one year (Exterro, Arsenal).

Frequently asked questions