Exterro Reviews

I have used Exterro at a couple of instances. I've used Exterro throughout my internships as a digital forensic consultant, as well as using Exterro, specifically the FTK Imager and FTK Toolkit, to teach my students in the digital forensics class I teach.

I mostly use Exterro for teaching. I usually give my students labs with digital forensics labs where we start off with trying to image the disk at hand, and that's where I use FTK Imager. I usually teach them about hashes, how to image, how to get registry, or even how to analyze memory by taking an image of the memory. Then we go on to analyzing the disk image to find deleted files, recovering artifacts like browser history, emails, and registry keys. The whole process is divided into several labs that I give to my students.

Exterro has been the very first tool I usually introduce to my students. Most of the time, my students come back and say that it's very intuitive. Since it's been the very first tool that they get introduced to in the class, it usually leaves a very lasting impact on them. Using Exterro in class has been really helpful in getting students to understand the fundamentals. I use Exterro as a live teaching tool rather than having a simulated environment. Students actually go through and use Exterro with real forensic disk images and practice the same workflow as a practicing examiner would.

I know this because I actually used Exterro for my internship. As a digital forensic consultant, we used to analyze all sorts of cases using Exterro, the FTK Toolkit, and the FTK Imager. I try to use the same workflow and the same methodology to teach students who are going to become digital forensic analysts using Exterro. This has been one of the most heavily used cases for Exterro.

I understand the features well. A few features that stand out to me, and I'll start with FTK Imager because that's the first tool I usually start with in my classes. FTK Imager is free and very reliable at the same time, and it has become an industry standard for evidence acquisition. I really like the fact that you can use it for imaging disks while at the same time you can use it to image memory. I do use it for both acquisitions.

The next thing that's really impressive to me is what I teach in class. The keyword search and indexing capability is very impressive in the sense that I'm able to quickly show or demonstrate, or have my students carve through large volumes of data to find relevant artifacts as well as deleted files. Deleted files and browser artifact recovery are a few topics that I teach my students. I particularly use Exterro because of its amazing performance with artifact recovery features. That is something that I always find impressive.

The biggest positive impact on students of Exterro has been readiness. By training students on Exterro or FTK, rather than simulating or having a watered-down tool, students actually graduate with hands-on experience in an industry-standard platform that employers actually use. This has shortened the learning curve for those who want to work in digital forensic roles. We're actually even considering having students go through the certification. I sat for the ACE certification about two years ago and recently took the GCFE exam, which included some experience or introductions with FTK Imager. I believe that it goes a long way. It essentially bridges the gap between academic learning and real-world practice, which is something I really appreciate.

Speed has been an issue, but at the same time, I wasn't sure if that is particularly something that could be improved because I understand that there are large forensic images and can take a significant amount of time to process. That has been one thing with my students. Usually when they're doing a lab, they have to take a lot of time to actually process the image. Sometimes I actually give them processed images for the latter labs, but when it comes to creating the disk images themselves and processing the images, it takes a lot of time. At the same time, sometimes the memory and hardware requirements could be demanding as well, specifically for lower-spec machines that students usually have. Although we do have lab machines that FTK runs on smoothly, for machines that students use, sometimes they can't be very high-end, so that is a real constraint.

Since I am in academia, I would actually think more in terms of the academic pricing and licensing model. I would really appreciate if Exterro actually has an academic pricing or licensing model. Sometimes the cost could be a barrier. If Exterro has an academic program where it could partner up with universities to even give out exam vouchers or have some students sit for the exam with a reduced price and work with the institution, that would be really great.

I've been working as an assistant professor for the past one year. However, I have been working in the digital forensics field for the last five years.

Exterro for the most part is stable and reliable when running on hardware that meets its system requirements. However, stability can actually be an issue when processing very large disk images or actually running on machines with limited RAM and processing power. That is something that is becoming a real consideration when using Exterro in the lab or in the classroom. Occasional crashes or freezes during intensive processing tasks have been observed by students, particularly when multiple features are being used simultaneously, but these are not frequent enough to say that Exterro is not doing a good job.

Exterro handles scalability reasonably well. The indexing engine is one of its very strongest suits. I can use it to process and search substantial volumes of data quite efficiently. That is nice, but scaling up does actually come with hardware and licensing demands, which can be constraints sometimes.

I am not sure if my students reached out for help because they usually reach out to me for help. When it comes to myself, I have reached out to customer support a few times, and they do offer resources, documentation, and they're really helpful for common issues. I haven't reached out to them as often as one should to be able to comment on this, hence I will not comment on that.

We did not switch to Exterro. We have always been using Exterro, especially FTK Imager. So we've always been using that.

Return on investment—time saved or other metrics like fewer employees needed or money saved—are not something that really resonates with me at this time. From an educational standpoint, the ROI would be evident in terms of student outcomes. Students who train on Exterro FTK tend to be better prepared for industry certifications. If you're using Exterro as a foundational tool, as the very first tool that you introduce students to, you would see that they become much more familiar with how the other tools would look like down the line, whether it's Magnet AXIOM or Cellebrite. They will actually know how to use them—not completely, but at least give them a starting point and a head start on it. So the ROI for me would be student outcomes.

Pricing can be one of the challenging aspects of Exterro, particularly for educational institutions. The full FTK license comes at a significant cost, which sometimes can be prohibitive for smaller institutions or individual students looking to practice outside of class. That actually adds an extra layer of complexity, especially when managing multiple machines in a lab environment. FTK Imager is available for free, which is a real positive. It allows students to get started with evidence acquisition without any cost barrier, which is something that students really appreciate because they can even use FTK Imager in their own time. A dedicated academic licensing tier with reduced pricing would make Exterro much more accessible to the educational community and help grow the next generation of digital forensic examiners.

I did not evaluate other options. I just started my job one year ago. Exterro has been used here, and I can explain why they would be using Exterro because it's almost evident. I've used Exterro during my PhD studies. It was actually one of the very first tools that I was introduced to. It's even one of the very foundational tools that is being used in the industry. When I was doing my internship as a digital forensic consultant in both civil and criminal areas, FTK Toolkit and FTK Imager would be one of the very first tools that I was introduced to everywhere. I can almost understand why students have been introduced to Exterro first.

Exterro is very easy to use. For ease of use, students are the best use case because they are actually coming in without any experience using any other tools when it comes to digital forensics. In terms of usability, usually students find having a learning curve at the very beginning, but just a few guidance tips or guidance here and there would help. I find it that it's intuitive compared to other tools on the market, which is why it is always the first tool that I introduce to them. Once students get past the initial complexity, they actually start to appreciate what the tool offers.

As for integrations, I feel that FTK fits naturally into the broader forensics workflow. Especially coming in from FTK Imager, you're able to get different image types, which down the line can be integrated into or can be used with multiple tools out there. It actually complements other tools in the field, such as Cellebrite, Magnet, and Autopsy, and that is why I actually use it.

I go ahead and use exam scores. Comparing lab scores versus exam scores, I usually give several labs. You would actually see labs that are being done on FTK Imager or the very starting labs getting much higher scores because of the ease of use, and it is such a foundational tool that is really important to be introduced to students early on and doesn't really have a very high learning curve compared to other tools. If you look at the lab scores and compare them to the lab scores of labs that require students to use other tools, you'll see quite a difference with FTK, with the labs using FTK Imager or FTK Toolkit having higher scores from students.

Exterro is a really good tool if you're starting out or just learning the foundational aspect of digital forensics. I think it's a solid introduction to digital forensics as a whole. Even using FTK Imager, it's a really reliable product for a free product. I think it would really solidify your digital forensic process, and I think it should be a mandatory tool that organizations actually use because it provides a lot of features that can be really helpful for day-to-day investigations. This review received a rating of eight out of ten.

As a forensic science student, I can realistically use Exterro for all of my academic work. It is very easy to understand and manage digital evidence. I use it for storage, tagging, and organized investigations, primarily to study digital evidence management and workflow using Exterro.

I try to incorporate what I have learned in my regular classes and apply it using Exterro, which helps me manage and understand the concepts better. I use Exterro for e-discovery, forensic and legal forensics, mobile evidence handling, and cyber crime investigation workflows. Comparing Exterro with Autopsy and FTK Imager, the UI, workflow, and reporting usability are much easier, which is why I use it.

Exterro has made me more efficient and productive. It is easier for me to manage evidence and get clearer results. It has been a much easier workplace for me compared to any other imaging or working environment.

I saved considerable time on projects that required extensive work. Exterro made it easier for me to manage everything quickly and find information more easily. It was very effective for me to understand the processes and everything involved. It was productive and saved me a significant amount of time.

The reporting and usability of Exterro are valuable to me. The investigation support is very good, and I can work with my evidence handling much better. The UI is also very good and easy to understand.

The reporting makes it easier for me to find information, and the filter system is much easier to incorporate what I have prepared. Compared to FTK Imager, it is much harder to find and manage information in other tools. Exterro makes it easier to know what I used last and allows me to restart from that particular point where I ended, then use it for my investigation and management.

I would like Exterro to be a complete forensics workflow. Currently it is effective for handling digital evidence, but it only compares with EnCase, FTK Imager, or Autopsy. I want this to expand beyond just digital evidence to include chain of custody and everything related to it across multiple categories of forensics, not just physical evidence, but every subdivision of forensics.

I want the mentioned categories to be involved more in Exterro with the existing features it already has regarding digital evidence. This would make it much easier for any officer, magistrate, or forensic expert to get into Exterro and begin their work. That would be much easier.

I have used Exterro for about two years and applied it to my forensics work as a forensic science student. I have made several projects using Exterro and found it very helpful.

Exterro can handle larger projects. My project was not that big, but I believe it can handle more.

I did not reach out for help, but the customer experience was good. I have seen positive feedback, and the customer service experience during this feedback process has been nice.

I was comparing Exterro with FTK Imager and other tools. They did not have AI features to make my work easier. Exterro was much easier, which is why I switched.

I did not formally evaluate other solutions, but I experimented with FTK Imager and Autopsy. Other than that, I have done all of my work on Exterro.

The initial setup was good. As a student, it was nice.

I do not remember the cost, but I did save time because I had a last-minute assignment. It was very easy and I could complete it on time. It was a good investment.

For anyone using FTK Imager or Autopsy, I would recommend that Exterro is much easier. The AI feature makes it much easier to handle and manage evidence collection. I have recommended Exterro to all my friends, colleagues, seniors, juniors, and teachers. Those who were working on projects have also felt very positive about Exterro's work.

I am having an excellent experience using Exterro. It has been a very fun and positive experience. Exterro is performing well, and my suggestion to expand into other forensic categories would enhance it further. Otherwise, they are doing great.

As a student working on Exterro, I sometimes need Exterro's help, so I mostly work on a private cloud only. I have completed a few projects on Exterro, and it has been very good and fine. My overall review rating for Exterro is nine out of ten.

My primary use case for Exterro includes data collection, chain of custody, and investigation of traces and evidence.

In my opinion, the best features that Exterro offers are that it is a very powerful tool for analysis and also for collecting information in digital investigations. I really use it a lot for performing the chain of custody and collecting and generating the image for conducting the investigation. My experience using FTK Imager shows that the product's speed and ease of use are particularly beneficial.

Exterro has had a positive impact on my organization by bringing many conveniences and delivering quick answers so that the board can make the best decision between terminating someone or even finding out if the person under investigation is or is not guilty in that incident. It is very important to carry out internal investigations with tools that guarantee the integrity of the data collected. Through this, it is possible to reach the truth of the facts and the reality of the facts. With that, it is possible to distinguish who really carried out the incident, who was involved in the incident, or who is being the victim of some kind of plot or collusion to harm that person. This way the company does not commit injustices.

In my opinion, Exterro can be improved with more accessible prices. By making the software more humanized at the financial level, it could be sold and have a culture of use across a much larger range of users and companies that today have this need but do not use FTK Suite because it is a very expensive tool.

I have had some difficulty with Exterro's stability during use. There was a crash, but I was not able to identify whether the crash was caused by the hardware or the software.

I rate customer support a nine. The company that provides us technical assistance is TechBiz here in Brazil. They are good at technical support for the products.

At the beginning of my career, I used many open-source solutions before switching to Exterro. The company I worked for already had FTK Suite as a tool, and I started practicing with it more. In my post-graduate training in computer forensics, Exterro, in this case FTK Suite, was used in the classroom. My learning culture for data, disk, and digital data investigation comes from college, in this case from my post-graduate course, which was based on this FTK platform.

I have obtained a return on investment using Exterro through a reduction in legal costs. Costs were reduced by being able to identify the fraud that occurred and thus take the decision to dismiss the person and provide the legal department with the necessary evidence for a dispute or litigation between the company and the former employee. The savings were very good because instead of paying all the costs of a dismissal, the severance payments, and all the compensations involved in an employee dismissal, the company was able to fire them for just cause without having to be obliged to pay any kind of benefit.

My experience with Exterro's pricing, setup costs, and licensing was not very good for personal use. For the company, since it is a renewal, they have a budget for it and then it took place routinely and easily. Every year the budget already included that amount to make a new update or a subscription renewal. There was no impact for the company at all. In my case, however, I was never able to have it because it is very expensive.

I researched other options on the market such as EnCase, Kali Linux, among other open-source solutions, including IPED, before deciding on Exterro.

I would advise other people who are thinking about using Exterro to do it in a very well-thought-out manner with tests and all the necessary evaluations and approvals because the investment is high. I gave this review an overall rating of nine.

My main use case for Exterro was MDM control. I used Exterro for MDM control by controlling my company's mobile devices.

In my opinion, the best features Exterro offers are complete, cheap, and free solutions. I appreciate the range of features, which seems to be the full package, and we are currently taking the free version, so it seems to be enough for us.

Exterro has positively impacted my organization with better control over devices. Since it has only been about 30 or 40 days, I cannot say much more about my experience because we are just starting.

Exterro could be improved because the documentation seems to be very short, and sometimes the kickoff setup is very tricky and confusing.

I have been working in my current field for about 20 years.

Exterro seems to be stable.

Exterro's scalability is as good as it gets.

I have not had any need for contacting support regarding customer service.

I did not previously use a different solution.

I tested Exterro for about two months. It is too early to tell if I noticed any time savings or improvements in efficiency with better control over my devices, but I think we are going to have better control over where my employees are and what activities they are developing.

I would not like to add more about the needed improvements.

It is still too early to see a return on investment. I have not saved any money yet.

My experience with pricing, setup cost, and licensing is zero cost and no licensing, which seems to be enough.

I did not evaluate other options before choosing Exterro.

My advice to others looking into using Exterro is to take a shot; I am very sure it will be good enough. I rated this review 9 out of 10.

My main use case for Exterro is to parse data whenever there is an incident in a company, so I often use Exterro to process the data and parse the artifact to find the relevant data according to the incident that has occurred.

A specific example of how I have used Exterro in a real incident involved an insider threat where an employee copied important data to a pen drive. With the help of Exterro, I parsed the image of that particular machine, and by correlating the USB artifact being used at that time and the activity of the logins that accessed that system, I correlated the USB timelines and other artifacts, such as MPAS and SIMCAS, as well as the use of the USB drive at that time, and accordingly set up the correlation of the timeline, proving that the employee copied the important file from the computer itself.

I often use Exterro to process data, regardless of whether there is an incident involving a threat actor, C2 connections, a compromised system by malware, insider threats, or HR compliance investigations where individuals extract data for personal use or might oversell it. In those cases, Exterro helps in finding malicious files, correlating data, and processing it so an investigator can use it in real scenarios to find artifacts and proofs of concepts that can be attached to reports, which are very useful for presenting to stakeholders, allowing both technical and non-technical individuals to easily understand the screenshots and artifacts collected during the data processing and analysis.

The best features Exterro offers include FTK Central, which has capabilities such as a GUI version of the investigation process for filtering and searching data plus tagging data for usefulness. Another feature is Cerberus, which provides sandboxing for particular files that help identify malicious data, which are often used for further investigations, significantly assisting in quickly finding malicious files in a system.

These features help make my investigations easier and more efficient as finding malicious files in a system is very hard without tools such as Exterro. Specifically, the Cerberus model gives a fast way to identify malicious files and flag them efficiently.

Exterro has positively impacted my organization by providing many features that aid in fast investigations of images, machines, systems, or files. It helps in structuring presentations and artifact processing so that our analysts can easily overview artifacts and present them effectively in reports that are useful for non-technical stakeholders.

I would like to add that Exterro should incorporate data processing improvements, such as for OVA files exported with cloud features such as AWS, which provide OBF files. The OBF feature should be included, and timeline sections should present artifacts in a way that allows for a tree view of multiple pieces of evidence processed simultaneously, which would help analysts handle investigations more efficiently.

Exterro can be improved by adding more sandboxing plugins or features since investigations increasingly require finding malicious files, processes, or any kind of DLLs or EXEs. If Exterro can integrate high-quality sandbox features such as Thread Gate or Fire Ice, it would greatly enhance the speed of investigations into malicious files.

I want to focus more on threat investigations, and I believe adding a timeline explorer would be beneficial. If Exterro FTK could ingest firewall logs or web access logs, it would assist in investigating cases related to defacement or beaconing activities present in particular files.

I have been using Exterro for around six years.

My advice to others looking into using Exterro is to go ahead with the product, as it is very useful. I have been using it for over five to six years, and it is particularly helpful for investigating any kind of incident and obtaining useful data pieces required for accurate findings. I would rate this product a seven out of ten.

I have been working in my current job for the last eight to ten months, and I have been in the cybersecurity field for the last three years. I have been using Exterro for the last one year. I typically use Exterro to teach students about FTK Imager, which is one of its products, and I teach students about these kinds of tools that are essential for digital forensics. We provide students with FTK Imager as a tool to image certain products when we want them to learn about imaging, and at that particular moment, we use it mainly to image hard disks and similar devices. I also use Exterro to provide an assignment that helps students learn about the different types of images and what kind of images can be worked with.

In my opinion, the best feature Exterro offers is the in-depth imaging process it provides. Exterro has positively impacted my students as they are fond of this tool that helps them extract information from dead phones, hard disks, and similar devices. I notice that students are more engaged and they complete assignments more successfully because using Linux for imaging is a bit hard, and using Exterro software is much more helpful for them.

I am not sure about the pricing, setup costs, and licensing for Exterro as that was taken care of by another colleague. I do not think I am capable of assessing the return on investment.

I find Exterro to be stable software, and I have no complaints about its reliability for imaging.

I think Exterro can handle more users or larger projects easily.

I have not interacted with Exterro's customer support, and I am not sure if my colleagues have done so.

Before Exterro, we did teach students different kinds of methods to image.

I considered other imaging software, including Linux for imaging; it is not just FTK.

I would advise that if someone wants software capable of imaging, then Exterro would be a great choice. I give this review a rating of 8.

We use Exterro as a glorified notification system. It was used by the Office of General Counsel and Debt Collections Group to notify employees that they needed to preserve emails or records, or whatever information they had that pertains to cases where we're suing members, for example. Legal hold matters.

It wasn't that we were necessarily using the tool for preservation of any kind. It was just that the old process was basically done through email — there was no structure behind it. That was kind of the main purpose for bringing Exterro in.

We are using a SaaS version of Exterro.

As far as increasing the usage, that might be TBD. We might expand and maybe other groups might use the tool. But for now, it's just mainly that first group, the Office of General Counsel, and the second group, Debt Collections.

As I mentioned, our old process had no structure around it. I guess you could say it's like an automated process. These emails are kind of generic, easy to track. So I would say that the benefit is more qualitative than quantitative. I think that would be the number one benefit — automating this process.

We like the reporting functionality. It just seems very clean. It just always looks like it can kind of slice and dice these reports and just show us the metrics that we need. I would say the reporting functionality is great.

I think one of the pain points I had was the number of emails that had to be sent out. If there was a way to just maybe reduce the bulk — that would be great. Like I mentioned before, OGC or the General Counsel, they're kind of the business owners of the tool. They're the ones that use it on a daily basis. So one of the things that would be helpful but we just can't do involves the way the role structures are set up. Any time that somebody outside of the Office of the General Council needs something, they need to contact the General Counsel directly in order to get that information from Exterro. I guess as far as a pain point, maybe a more robust role-based access model would be useful.

We had to go through a third-party to use it. I understand the risk because you don't want anybody to just go into Exterro and potentially see legal matters, but I think it's just the way we have it set up — it's an all-or-nothing type role-based model. That's why only the General Council can use it.

If the roles could be scaled in a way where let's say, a visitor role could come into the tool and view a report, that we can't do right now. So if there was a way to do that, I think that would be nice to have. 

Stability-wise, I think it's really good. Phase one of the project only involved the office of the General Counsel, which was a smaller group, smaller number of legal matters, smaller number of emails, and things like that. But it was flexible. It had to be scalable because the volume that was coming from the second group, Debt Collections, was pretty big. So yeah, I would say that overall, it was good in that area.

We expanded the solution. We only have six or seven user licenses, so it's a small group. The way they use the tool is when litigation is received, they use the tool to notify people that they may have some information that needs to be preserved as part of a legal matter. As I said, a glorified notification system.

Technical support is good. We know the people to contact from the Exterro side. I can only think of one situation where we had a problem with one user who might've received a legal hold or a notification that wasn't supposed to go out. It was just a bug or something like that, but that was resolved pretty quickly. Other than that incident, we have rarely had to contact technical support.

The process that we had before was manual. For example, if I needed you to preserve something, I'd email that to you. I'd email you something letting you know, and then I track it on a spreadsheet. So it was a manual process.

The initial setup was pretty straightforward.

For deployment, we had a PM, we had a tech lead from our side, a few records and information management people — probably 10 people max. A combination of technical people, the PM, and some subject matter experts from the General Counsel side, the Debt Collection side, and the Records and Information Management side.

I think once we got past some of the testing and UAT, deployment happened within a month.

My role in it was from the Records and Information Management side. I needed to understand the tool: what records, if any, are being stored in it; ensuring retention policies were included; and things like that. As far as the design and customization, that was something that the Office of General Counsel was more involved in it because they were the ones that used the tool daily.

We used a waterfall approach for implementation.

We have some recurring maintenance, which I feel is standard. 

As far as ROI, as I stated earlier, it's more qualitative than quantitative I'd say. It's a manual process that's automated now. There definitely was a kind of risk avoidance. So we lowered our risk because we have more control over the process. We're not at any risk of deleting information that shouldn't be deleted. We lowered that risk, but I don't know if I could associate a cost with that. 

We don't have that many licenses. But I'm assuming if we need to grow, that wouldn't be a problem. Can't really say much on the pricing, but the licensing part seems pretty straightforward because we might have more groups coming on and we'll be able to add those licenses.

I would recommend Exterro. It seems to work just fine for the businesses that use it on a daily basis. I think there is even a preservation mechanism in the tool that you can add on, but we just haven't implemented it. There are tons of other things that you can do with it. So yes, I would recommend it. I would say it's a good tool.

The biggest lesson I've learned is that the tool can handle a large volume of notifications and emails. It takes a lot of manual processes out, saves time, and lowers overall organizational risks. Those are just some of the highlights that I learned going in because, I'll admit, when we first started looking at vendors, I had never heard of Exterro at that time. I would say that those items kind of highlight what I've learned from Exterro.

Overall, on a scale from one to ten, I would give Exterro a rating of eight.