Many Endpoint Detection and Response (EDR) tools flag the FTK driver as suspicious because it behaves like a rootkit to gain direct hardware access.
⚠️ Reduces security but allows legacy driver.
: Some security suites block the low-level driver FTK uses to read raw disk data. Temporarily disable your antivirus to test. ftk imager could not start driver
Are you seeing this error when or after you've already selected a specific drive to image? FTK Imager 4.7 - Exterro
⚠️ Note: This is not recommended for production forensic workstations long-term but is acceptable for a one-time acquisition. Many Endpoint Detection and Response (EDR) tools flag
Reinstall FTK Imager
: Newer versions of Windows (10 and 11) have strict requirements for signed drivers. If the FTK driver is outdated, Windows may block it from loading. Temporarily disable your antivirus to test
sc delete ADImagerDriver