This is the most common fix. Even if your user account is an administrator, Windows User Account Control (UAC) may prevent FTK from loading the required kernel driver.
The error "FTK Imager could not start driver (new)" is almost exclusively a Windows permissions or environment issue. In 90% of cases, simply closing the application and re-opening it with "Run as Administrator" will resolve the problem. If the issue persists, checking for conflicting hidden drivers in Device Manager or temporarily disabling antivirus software are your next best steps.
Troubleshooting "FTK Imager Could Not Start Driver" Errors If you encounter the error message "FTK Imager could not start driver" or similar driver-loading failures, it typically indicates that the operating system's security features or missing dependencies are preventing the tool from accessing low-level hardware. This is a common issue when running newer versions of FTK Imager on modern Windows 10 or 11 systems.
Below are the most effective methods to resolve this issue and get your forensic imaging back on track. 1. Disable Windows Memory Integrity (Core Isolation)
The most frequent cause of driver failure in FTK Imager on Windows 11 and recent versions of Windows 10 is the Memory Integrity feature. This security layer may block older or unsigned drivers used by forensic tools. How to fix it: Open Windows Security (search for it in the Start menu). Navigate to Device security > Core isolation details. Toggle Memory integrity to Off. Restart your computer to apply the changes. 2. Run as Administrator
FTK Imager requires administrative privileges to load its drivers and interact with physical drives.
How to fix it: Right-click the FTK Imager executable or shortcut and select Run as administrator. If you are using the Lite version, try launching it from an Admin Command Prompt to bypass certain certificate verification issues. 3. Verify Missing Dependencies (DLLs)
Newer versions of FTK Imager (especially 64-bit versions and version 4.5.0+) require specific Microsoft Foundation Class (MFC) files and Visual C++ redistributable DLLs. If these are missing from the system or the USB drive (if running a portable version), the driver will fail to start. How to fix it:
Ensure the Microsoft Visual C++ Redistributable packages are installed on the host machine. ftk imager could not start driver new
If running from a USB, ensure you have copied the entire installation folder, including all necessary library files. 4. Switch to a Different Version
If you are using FTK Imager Lite (version 3.1.1 or older), you may face constant driver issues on modern Windows builds due to revoked signing certificates.
The error "FTK Imager could not start driver" typically occurs during memory capture or physical drive acquisition on modern operating systems. It is often a conflict between the tool's legacy drivers and newer Windows security features or hardware architectures. Common Fixes for "Could Not Start Driver" If you are seeing this error, try these proven workarounds:
Run as Administrator: This is the most common requirement. Right-click the FTK Imager.exe and select Run as Administrator to ensure the tool has permission to load kernel-level drivers.
Use Admin Command Prompt: Launch a Command Prompt as an administrator and run the FTK Imager executable (especially for FTK Imager Lite) directly from the command line.
Disable Driver Signature Enforcement: Modern Windows (10/11) may block the driver because its signing certificate was revoked or is considered legacy. You can temporarily disable this through the Advanced Startup menu to see if the driver loads successfully.
Check ARM vs. x64 Architecture: If you are running Windows 11 on an ARM-based machine (like an M1/M2/M3 Mac via Parallels), FTK Imager's x64 drivers may fail to load because they are not compatible with the ARM architecture. Review of FTK Imager (Exterro)
FTK Imager remains a staple in digital forensics due to its price (free) and reliability for standard imaging tasks, but it shows its age in modern environments. This is the most common fix
Versatility: It excels at creating Physical and Logical Images in various formats including E01, Raw (dd), and AD1.
Reliability vs. Speed: While highly trusted, recent benchmarks show it is significantly slower than newer tools like OSForensics or X-Ways Imager, especially when compression is enabled.
User Interface: The UI is considered outdated and simplistic, which is great for beginners but lacks the advanced features found in paid forensic suites.
Stability Issues: Users have reported "white screen" freezes and serious performance drops when verifying images over a network or dealing with potentially corrupted partition tables. Alternative Tools If the driver error persists, consider these alternatives:
Magnet Acquire: A free, more modern imaging tool that often handles newer Windows drivers better.
Sumuri PALADIN: A bootable Linux environment that bypasses Windows driver issues entirely to image drives.
KAPE: While not a bit-for-bit imager, it is superior for rapid logical evidence collection.
Sometimes the driver service gets "stuck." If FTK Imager crashed previously, the service might still be registered as running in the background, preventing a new instance from starting. The error "FTK Imager could not start driver
Since Windows 8 and Windows Server 2012, Microsoft has required that all kernel-mode drivers be digitally signed by Microsoft (not just any certificate). Older versions of FTK Imager (e.g., 3.x and early 4.x) use drivers that are either unsigned or use signatures that Microsoft’s Security Center no longer trusts.
If administrator privileges didn't help, Windows might be rejecting the driver's signature.
Steps (Windows 10/11):
Warning: This disables a critical security feature. Use only for testing. If FTK Imager works, you have identified signature enforcement as the root cause. See Solution 6 for a permanent fix.
Starting a kernel driver requires elevated rights. If you launch FTK Imager without "Run as administrator", the driver installation/start request will be denied.
If the automatic driver installation fails, you can attempt to manually install it.
Prerequisite: Locate the driver file. In newer FTK Imager versions, the .sys file may be extracted on-the-fly. Check:
Manual Registration:
To remove later:
sc stop FTKImagerDriver
sc delete FTKImagerDriver
AccessData offers a Portable (ZIP) version of FTK Imager that does not rely on a permanently installed driver. This version extracts and loads the driver on-the-fly from the user's temp folder. While it can still trigger signature issues, it is more resilient on locked-down corporate machines.