Digital Forensics Showdown: Encase and FTK Head-to-Head

Due to constant revolution in technology and increase in anti-forensic techniques used by the attackers to remove their traces, professionals often struggle to choose the best tool to be used in digital forensic investigations.This paper compares two most well known and widely used licensed commercial tools i.e. Encase & FTK. The comparison was drawn on various parameters and features to provide an authentic evaluation of licensed version of these well-known commercial tools against various real world scenarios. In order to discover the popularity of these tools within the digital forensic community, a survey was conducted publicly to determine the preferred choice. The dataset used is Computer Forensics Reference Dataset (CFReDS). A total of 70 features were selected from various categories. Upon comparison, both FTK and EnCase produce remarkable results. However, each tool has some limitations and none of the tool is declared best. The comparison drawn is completely unbiased, based on factual data. The purpose of this research is to help the investigator to choose the appropriate tool depending on the existing scenario.