Exterro Legal Hold

As a forensic science student, I can realistically use Exterro for all of my academic work. It is very easy to understand and manage digital evidence. I use it for storage, tagging, and organized investigations, primarily to study digital evidence management and workflow using Exterro.

I try to incorporate what I have learned in my regular classes and apply it using Exterro, which helps me manage and understand the concepts better. I use Exterro for e-discovery, forensic and legal forensics, mobile evidence handling, and cyber crime investigation workflows. Comparing Exterro with Autopsy and FTK Imager, the UI, workflow, and reporting usability are much easier, which is why I use it.

Exterro has made me more efficient and productive. It is easier for me to manage evidence and get clearer results. It has been a much easier workplace for me compared to any other imaging or working environment.

I saved considerable time on projects that required extensive work. Exterro made it easier for me to manage everything quickly and find information more easily. It was very effective for me to understand the processes and everything involved. It was productive and saved me a significant amount of time.

The reporting and usability of Exterro are valuable to me. The investigation support is very good, and I can work with my evidence handling much better. The UI is also very good and easy to understand.

The reporting makes it easier for me to find information, and the filter system is much easier to incorporate what I have prepared. Compared to FTK Imager, it is much harder to find and manage information in other tools. Exterro makes it easier to know what I used last and allows me to restart from that particular point where I ended, then use it for my investigation and management.

I would like Exterro to be a complete forensics workflow. Currently it is effective for handling digital evidence, but it only compares with EnCase, FTK Imager, or Autopsy. I want this to expand beyond just digital evidence to include chain of custody and everything related to it across multiple categories of forensics, not just physical evidence, but every subdivision of forensics.

I want the mentioned categories to be involved more in Exterro with the existing features it already has regarding digital evidence. This would make it much easier for any officer, magistrate, or forensic expert to get into Exterro and begin their work. That would be much easier.

I have used Exterro  for about two years and applied it to my forensics work as a forensic science student. I have made several projects using Exterro  and found it very helpful.

Exterro can handle larger projects. My project was not that big, but I believe it can handle more.

I did not reach out for help, but the customer experience was good. I have seen positive feedback, and the customer service experience during this feedback process has been nice.

I was comparing Exterro with FTK Imager and other tools. They did not have AI features to make my work easier. Exterro was much easier, which is why I switched.

I did not formally evaluate other solutions, but I experimented with FTK Imager and Autopsy. Other than that, I have done all of my work on Exterro.

The initial setup was good. As a student, it was nice.

I do not remember the cost, but I did save time because I had a last-minute assignment. It was very easy and I could complete it on time. It was a good investment.

For anyone using FTK Imager or Autopsy, I would recommend that Exterro is much easier. The AI feature makes it much easier to handle and manage evidence collection. I have recommended Exterro to all my friends, colleagues, seniors, juniors, and teachers. Those who were working on projects have also felt very positive about Exterro's work.

I am having an excellent experience using Exterro. It has been a very fun and positive experience. Exterro is performing well, and my suggestion to expand into other forensic categories would enhance it further. Otherwise, they are doing great.

As a student working on Exterro, I sometimes need Exterro's help, so I mostly work on a private cloud only. I have completed a few projects on Exterro, and it has been very good and fine. My overall review rating for Exterro is nine out of ten.

I have been working in my current job for the last eight to ten months, and I have been in the cybersecurity field for the last three years. I have been using Exterro  for the last one year. I typically use Exterro  to teach students about FTK Imager, which is one of its products, and I teach students about these kinds of tools that are essential for digital forensics. We provide students with FTK Imager as a tool to image certain products when we want them to learn about imaging, and at that particular moment, we use it mainly to image hard disks and similar devices. I also use Exterro to provide an assignment that helps students learn about the different types of images and what kind of images can be worked with.

In my opinion, the best feature Exterro offers is the in-depth imaging process it provides. Exterro has positively impacted my students as they are fond of this tool that helps them extract information from dead phones, hard disks, and similar devices. I notice that students are more engaged and they complete assignments more successfully because using Linux for imaging is a bit hard, and using Exterro software is much more helpful for them.

I am not sure about the pricing, setup costs, and licensing for Exterro as that was taken care of by another colleague. I do not think I am capable of assessing the return on investment.

I find Exterro to be stable software, and I have no complaints about its reliability for imaging.

I think Exterro can handle more users or larger projects easily.

I have not interacted with Exterro's customer support, and I am not sure if my colleagues have done so.

Before Exterro, we did teach students different kinds of methods to image.

I considered other imaging software, including Linux for imaging; it is not just FTK.

I would advise that if someone wants software capable of imaging, then Exterro would be a great choice. I give this review a rating of 8.

My main use case for Exterro  is conducting forensic analysis with email. After gathering the emails of a company that had a data leak, I used Exterro  to identify the central point of this leak and the concatenation of the data on a platform.

In addition to forensic analysis with email, Exterro helps me with various types of cases, both more complex cases and post-mortem forensic cases. In all the cases I work on, I use it in my day-to-day work, whether for card data leaks or for validating forensic analyses involving image data.

Exterro has a positive impact on my organization because it brings differentiation because of the name and because I am a certified professional. I have already worked selling various prevention tools, but since it is a standard tool and the first on the market, this carries much more weight in execution and for the professional. Professionals are considered more qualified when they use Exterro.

Beyond this market recognition and the certification, I have noticed a practical impact in terms of faster execution of activities. I can load an image and perform a forensic analysis only on what I need to do, so I do not waste much time. This helps me considerably.

I would not say the best feature of Exterro, but rather the work format. Because it reads the disk's MFT  and only extracts the data for me when I need it, this greatly facilitates the validation of the process itself, giving me speed. Because it does not archive and pull up all the data on the computer, it makes things lighter and gives me peace of mind to do exactly what I really need to do. The difference between Exterro and other tools on the market is precisely that it gives you the peace of mind to perform only what you need without having to do a full disk acquisition before you start your work.

By giving me this ease, Exterro allows me to search precisely for what I need, enabling me to start a service in a simple way, carry out a complex job, but still focus only on what I need to perform. Since I started using it, Exterro has given me this differentiator, in addition to the market differentiator it gives me, which is the certification.

Exterro could be more accessible, as it is not a very accessible tool for other experts to use, except law enforcement.

I would add some artificial intelligence with basic knowledge of the tool to make it easier for those who are starting out, which would be interesting.

The experience with Exterro's pricing, setup costs, and licensing is very bad because it is a very expensive tool. Other tools on the market do the same things but are much more affordable. I would actually reduce the cost, especially for Exterro Forensic, making it more viable for the market. If new modules were needed, then there could be an add-on cost, but I would make the tool cheaper when discussing Exterro Forensic.

I would create a model similar to FTK Imager and create something free for data collection, which would be interesting for Exterro to have.

I have been using Exterro for approximately 17 to 18 years.

Exterro is very stable and it is the best on the market.

Exterro's scalability is not very high because when I am analyzing a disk, depending on my machine, if I push it a bit more, it can become unstable. However, for today's demand and for a local module, it easily meets the need.

Exterro has good support and documentation, which makes it easy to use. However, I would add some artificial intelligence with basic knowledge of the tool to make it easier for those who are starting out, which would be interesting.

I have never needed to use Exterro's technical support, only when acquiring licenses.

I did not use a different solution before, but I used all of them because I was in pre-sales. I used FTK, Belkasoft, and Exterro itself, along with several other tools.

In terms of return on investment, I usually have a quantitative measure in relation to hours worked. I can reduce my hours worked with Exterro in order to have a higher gain. However, I would find it interesting to receive some benefit from the tool, such as being a representative or having some enabler to promote my long-term experience, as I have been working for 20 years.

The experience with Exterro's pricing, setup costs, and licensing is very bad because it is a very expensive tool. Other tools on the market do the same things but are much more affordable.

I evaluated other options, including FTK and Belkasoft, among others.

My advice to others thinking about using Exterro is to professionalize themselves and get certified, as it is not a very intuitive tool and you have to make an effort to find what you want. Prepare yourself, study, get certified, and then use it.

The only point I would emphasize about Exterro is the cost reduction and the creation of a disk copy tool similar to the one FTK has.

I would rate this review a 10.

I have used Exterro  at a couple of instances. I've used Exterro  throughout my internships as a digital forensic consultant, as well as using Exterro, specifically the FTK Imager and FTK Toolkit, to teach my students in the digital forensics class I teach.

I mostly use Exterro for teaching. I usually give my students labs with digital forensics labs where we start off with trying to image the disk at hand, and that's where I use FTK Imager. I usually teach them about hashes, how to image, how to get registry, or even how to analyze memory by taking an image of the memory. Then we go on to analyzing the disk image to find deleted files, recovering artifacts like browser history, emails, and registry keys. The whole process is divided into several labs that I give to my students.

Exterro has been the very first tool I usually introduce to my students. Most of the time, my students come back and say that it's very intuitive. Since it's been the very first tool that they get introduced to in the class, it usually leaves a very lasting impact on them. Using Exterro in class has been really helpful in getting students to understand the fundamentals. I use Exterro as a live teaching tool rather than having a simulated environment. Students actually go through and use Exterro with real forensic disk images and practice the same workflow as a practicing examiner would.

I know this because I actually used Exterro for my internship. As a digital forensic consultant, we used to analyze all sorts of cases using Exterro, the FTK Toolkit, and the FTK Imager. I try to use the same workflow and the same methodology to teach students who are going to become digital forensic analysts using Exterro. This has been one of the most heavily used cases for Exterro.

I understand the features well. A few features that stand out to me, and I'll start with FTK Imager because that's the first tool I usually start with in my classes. FTK Imager is free and very reliable at the same time, and it has become an industry standard for evidence acquisition. I really like the fact that you can use it for imaging disks while at the same time you can use it to image memory. I do use it for both acquisitions.

The next thing that's really impressive to me is what I teach in class. The keyword search and indexing capability is very impressive in the sense that I'm able to quickly show or demonstrate, or have my students carve through large volumes of data to find relevant artifacts as well as deleted files. Deleted files and browser artifact recovery are a few topics that I teach my students. I particularly use Exterro because of its amazing performance with artifact recovery features. That is something that I always find impressive.

The biggest positive impact on students of Exterro has been readiness. By training students on Exterro or FTK, rather than simulating or having a watered-down tool, students actually graduate with hands-on experience in an industry-standard platform that employers actually use. This has shortened the learning curve for those who want to work in digital forensic roles. We're actually even considering having students go through the certification. I sat for the ACE  certification about two years ago and recently took the GCFE exam, which included some experience or introductions with FTK Imager. I believe that it goes a long way. It essentially bridges the gap between academic learning and real-world practice, which is something I really appreciate.

Speed has been an issue, but at the same time, I wasn't sure if that is particularly something that could be improved because I understand that there are large forensic images and can take a significant amount of time to process. That has been one thing with my students. Usually when they're doing a lab, they have to take a lot of time to actually process the image. Sometimes I actually give them processed images for the latter labs, but when it comes to creating the disk images themselves and processing the images, it takes a lot of time. At the same time, sometimes the memory and hardware requirements could be demanding as well, specifically for lower-spec machines that students usually have. Although we do have lab machines that FTK runs on smoothly, for machines that students use, sometimes they can't be very high-end, so that is a real constraint.

Since I am in academia, I would actually think more in terms of the academic pricing and licensing model. I would really appreciate if Exterro actually has an academic pricing or licensing model. Sometimes the cost could be a barrier. If Exterro has an academic program where it could partner up with universities to even give out exam vouchers or have some students sit for the exam with a reduced price and work with the institution, that would be really great.

I've been working as an assistant professor for the past one year. However, I have been working in the digital forensics field for the last five years.

Exterro for the most part is stable and reliable when running on hardware that meets its system requirements. However, stability can actually be an issue when processing very large disk images or actually running on machines with limited RAM and processing power. That is something that is becoming a real consideration when using Exterro in the lab or in the classroom. Occasional crashes or freezes during intensive processing tasks have been observed by students, particularly when multiple features are being used simultaneously, but these are not frequent enough to say that Exterro is not doing a good job.

Exterro handles scalability reasonably well. The indexing engine is one of its very strongest suits. I can use it to process and search substantial volumes of data quite efficiently. That is nice, but scaling up does actually come with hardware and licensing demands, which can be constraints sometimes.

I am not sure if my students reached out for help because they usually reach out to me for help. When it comes to myself, I have reached out to customer support a few times, and they do offer resources, documentation, and they're really helpful for common issues. I haven't reached out to them as often as one should to be able to comment on this, hence I will not comment on that.

We did not switch to Exterro. We have always been using Exterro, especially FTK Imager. So we've always been using that.

Return on investment—time saved or other metrics like fewer employees needed or money saved—are not something that really resonates with me at this time. From an educational standpoint, the ROI would be evident in terms of student outcomes. Students who train on Exterro FTK tend to be better prepared for industry certifications. If you're using Exterro as a foundational tool, as the very first tool that you introduce students to, you would see that they become much more familiar with how the other tools would look like down the line, whether it's Magnet AXIOM  or Cellebrite. They will actually know how to use them—not completely, but at least give them a starting point and a head start on it. So the ROI for me would be student outcomes.

Pricing can be one of the challenging aspects of Exterro, particularly for educational institutions. The full FTK license comes at a significant cost, which sometimes can be prohibitive for smaller institutions or individual students looking to practice outside of class. That actually adds an extra layer of complexity, especially when managing multiple machines in a lab environment. FTK Imager is available for free, which is a real positive. It allows students to get started with evidence acquisition without any cost barrier, which is something that students really appreciate because they can even use FTK Imager in their own time. A dedicated academic licensing tier with reduced pricing would make Exterro much more accessible to the educational community and help grow the next generation of digital forensic examiners.

I did not evaluate other options. I just started my job one year ago. Exterro has been used here, and I can explain why they would be using Exterro because it's almost evident. I've used Exterro during my PhD studies. It was actually one of the very first tools that I was introduced to. It's even one of the very foundational tools that is being used in the industry. When I was doing my internship as a digital forensic consultant in both civil and criminal areas, FTK Toolkit and FTK Imager would be one of the very first tools that I was introduced to everywhere. I can almost understand why students have been introduced to Exterro first.

Exterro is very easy to use. For ease of use, students are the best use case because they are actually coming in without any experience using any other tools when it comes to digital forensics. In terms of usability, usually students find having a learning curve at the very beginning, but just a few guidance tips or guidance here and there would help. I find it that it's intuitive compared to other tools on the market, which is why it is always the first tool that I introduce to them. Once students get past the initial complexity, they actually start to appreciate what the tool offers.

As for integrations, I feel that FTK fits naturally into the broader forensics workflow. Especially coming in from FTK Imager, you're able to get different image types, which down the line can be integrated into or can be used with multiple tools out there. It actually complements other tools in the field, such as Cellebrite, Magnet, and Autopsy, and that is why I actually use it.

I go ahead and use exam scores. Comparing lab scores versus exam scores, I usually give several labs. You would actually see labs that are being done on FTK Imager or the very starting labs getting much higher scores because of the ease of use, and it is such a foundational tool that is really important to be introduced to students early on and doesn't really have a very high learning curve compared to other tools. If you look at the lab scores and compare them to the lab scores of labs that require students to use other tools, you'll see quite a difference with FTK, with the labs using FTK Imager or FTK Toolkit having higher scores from students.

Exterro is a really good tool if you're starting out or just learning the foundational aspect of digital forensics. I think it's a solid introduction to digital forensics as a whole. Even using FTK Imager, it's a really reliable product for a free product. I think it would really solidify your digital forensic process, and I think it should be a mandatory tool that organizations actually use because it provides a lot of features that can be really helpful for day-to-day investigations. This review received a rating of eight out of ten.