Error Report: FTK Imager Could Not Start Driver New
Introduction
FTK Imager is a popular digital forensics tool used to create forensic images of drives and devices. However, some users have reported encountering an error message "FTK Imager could not start driver new" while attempting to use the tool. This report aims to provide an overview of the error, its possible causes, and potential solutions.
Error Description
The error message "FTK Imager could not start driver new" typically occurs when a user attempts to launch FTK Imager or create a new forensic image. The error message indicates that the tool is unable to start a required driver, which is necessary for the imaging process.
Possible Causes
Several factors may contribute to this error:
Solutions
To resolve the error "FTK Imager could not start driver new," try the following:
Recommendations
To prevent similar errors in the future, it is recommended to: ftk imager could not start driver new
Conclusion
The error "FTK Imager could not start driver new" can be caused by a variety of factors, including outdated drivers, insufficient privileges, and hardware issues. By following the recommended solutions and best practices outlined in this report, users should be able to resolve the error and successfully use FTK Imager to create forensic images. If the issue persists, further assistance from AccessData support or a qualified digital forensics professional may be necessary.
The error "Could Not Start Driver" in FTK Imager typically occurs when the application's kernel-mode drivers—often used for capturing volatile memory (RAM) or mounting images—fail to load.
The most effective "feature" or troubleshooting step to fix this is to manually clear existing driver registrations and ensure the application has the highest level of system permission. Recommended Fixes
Remove Conflicting Driver Registrations: Open a Command Prompt as Administrator and run the following commands to delete old service entries that may be blocking the new driver from starting: sc delete cbdisk sc delete cbdisk2 Note: Reboot your computer after running these commands.
Run as Administrator: Ensure you are launching the executable by right-clicking it and selecting Run as administrator. This is often required to load the necessary drivers for low-level system access.
Disable Driver Signature Enforcement: On modern Windows versions (especially Windows 11), the driver may not be digitally signed to meet new security standards. You can temporarily disable this via Advanced Startup Settings (Troubleshoot > Advanced Options > Startup Settings > Restart > Option 7).
Check Hardware Compatibility: If you are using a Mac with an M1/M2/M3 chip running Windows in a virtual machine (like Parallels), FTK Imager's x86-based drivers may fail because they are not compatible with the ARM architecture. Common Root Causes
Old Installations: Residual files from older versions of FTK Imager (like version 3.4.x) can conflict with the driver initialization of newer versions.
Security Software: Antivirus or Endpoint Detection and Response (EDR) tools may block the driver from loading, as it performs "suspicious" low-level memory operations. Error Report: FTK Imager Could Not Start Driver
Corrupted Files: The FTK Imager.exe or its associated .sys driver files may be corrupted. A fresh reinstall from the Exterro Download Page often resolves this.
If you're still stuck, it helps to know if you're trying to capture RAM or mount an image, as the fix might differ!
The "Could Not Start Driver" error in FTK Imager typically occurs when the application lacks the necessary permissions or when Windows security features block its specialized forensic drivers . Quick Fixes
Run as Administrator: This is the most common solution . Right-click the FTK Imager executable and select Run as Administrator to ensure it has the system-level permissions required to load its drivers .
Use Command Prompt: If the standard interface fails, open a Command Prompt as Administrator and launch the application directly from there . This often bypasses revoked certificate issues or OS blocks .
Disable Memory Integrity (Core Isolation): Modern Windows security can block drivers it deems incompatible . Go to Windows Security > Device Security > Core Isolation and toggle Memory Integrity to Off . Troubleshooting Specific Scenarios
ARM-based Hardware: If you are using a device with an ARM processor (like an M1/M2 Mac running Windows via Parallels), FTK Imager's x64 drivers may fail to start because they are not compatible with ARM architecture .
Portable/Lite Version Issues: If you are running the "Lite" version from a USB drive, try switching to the full portable version (v4.3 or higher) .
Missing Dependencies: Ensure all required Microsoft Foundation Class (MFC) and Visual C++ Redistributable files are present in the application folder, especially when running from removable media .
Alternative Tools: If the error persists, consider using other free forensic imaging tools like Magnet Acquire or EnCase Imager . Outdated or corrupted drivers : The error may
Are you running FTK Imager on a physical machine or inside a virtual environment?
Modern Windows 10/11 machines often have Memory Integrity (Core Isolation) enabled. This feature blocks any driver that hasn't been tested and certified by Microsoft. FTK Imager’s driver often fails this test.
Older versions (before 4.3.0) have known driver issues on Windows 10 20H2 and later. AccessData/Exterro has released updated signatures.
Steps:
Several scenarios trigger this failure:
If you disabled driver signature enforcement or Memory Integrity just to run FTK Imager, you will have to repeat those steps after each reboot. That is burdensome. Here is the permanent professional solution:
A: Yes, but you must use FTK Imager 4.5.0 or higher. Early Windows 11 builds (21H2) require disabling driver signature enforcement or enabling Test Mode.
FTK Imager is the gold-standard tool for digital forensics. It is lightweight, portable, and incredibly powerful for creating disk images and previewing evidence. However, even seasoned investigators occasionally hit a frustrating roadblock: "FTK Imager could not start driver new."
This error typically appears the moment you try to launch the application. You double-click the icon, wait for the splash screen, and instead of the GUI, you are met with a cryptic message box: "Could not start driver new." The application then shuts down.
If you are seeing this message, do not panic. This article provides a deep dive into why this happens, the role of kernel drivers in FTK Imager, and step-by-step solutions to get you back to your investigation.