Ftk Imager Could Not Start Driver
Open Command Prompt as Administrator and run:
sc query FTKDriver
Check if it exists. If not installed:
cd "C:\Program Files\AccessData\FTK Imager\"
FTKDriver.exe -install
Then start it:
sc start FTKDriver
If it fails with an error (e.g., 1275 – driver blocked), check the next steps.
If running as admin fails, Windows may be blocking the driver because it lacks a proper signature (especially on older FTK Imager versions).
For Windows 10/11:
Warning: This lowers system security and should only be used on isolated forensic workstations or virtual machines. Do not browse the internet or open untrusted files while signature enforcement is disabled.
FTK Imager is a staple forensic tool used for creating disk images, previewing drives, and capturing memory. However, users often encounter a frustrating error when launching the application on Windows, particularly on Windows 10 and 11:
"Could not start driver. Please reboot and try again. If the problem persists, please reinstall FTK Imager."
This error indicates that the FTK Imager Driver, a kernel-mode driver used for direct disk access (bypassing Windows file system restrictions), failed to load. This guide explores why this happens and provides step-by-step solutions.
The "Could Not Start Driver" error in FTK Imager typically occurs during memory capture when the program cannot load its kernel-level driver
. This is often due to modern Windows security features blocking non-compliant or unsigned drivers. Microsoft Support Quick Fixes Run as Administrator : Right-click the FTK Imager icon and select Run as administrator
. The driver requires elevated privileges to interact with the system kernel. Disable Core Isolation (Memory Integrity) Windows Security Device Security Core isolation details Memory integrity and restart your computer. Check Hardware Compatibility (ARM vs. x64)
: If you are running FTK Imager on an ARM-based device (like a Mac with an M-series chip using Parallels), the standard x64 driver will not load. Microsoft Support Advanced Troubleshooting Disable Driver Signature Enforcement Restart Windows into Advanced Startup (Shift + Restart). Navigate to Troubleshoot Advanced options Startup Settings to "Disable driver signature enforcement". Replace Corrupt Files : Reinstall the application or replace the file with a fresh copy from the official Exterro website to ensure no files are missing or corrupt. Use Command Line
: If the GUI continues to fail, try running FTK Imager from the Command Prompt (as Admin) to bypass certain UI-related security blocks. alternative tools for memory capture if FTK Imager continues to fail?
The "Could Not Start Driver" error in FTK Imager typically surfaces during memory captures or physical drive access when the operating system blocks the application's low-level driver from loading. Why This Happens
FTK Imager uses a kernel-level driver to bypass standard Windows file system protections and access raw hardware or memory. Modern Windows security features often flag this driver as a threat.
Memory Integrity / Core Isolation: A Windows security feature that uses hardware virtualization to protect system processes. It often prevents older or unsigned drivers—like those used by specific versions of FTK Imager—from loading to prevent malware injection.
Driver Signature Enforcement: Windows 10 and 11 strictly require drivers to be digitally signed by Microsoft. If the version of FTK Imager you are using has an outdated or incompatible signature for your current Windows build, the driver will fail to start.
Virtualization Conflicts: Running FTK Imager inside a Virtual Machine (VM) can cause driver failures if the host prevents the VM from accessing the physical hardware or if there is a conflict with the hypervisor's own drivers. How to Fix It
Run as Administrator: Ensure you are running the application with elevated privileges to give the driver the necessary permissions to attempt a start. Disable Memory Integrity:
Go to Windows Security > Device Security > Core Isolation details. Toggle Memory Integrity to Off and restart your computer. Disable Driver Signature Enforcement (Temporary):
Restart Windows while holding the Shift key to enter the recovery menu.
Navigate to Troubleshoot > Advanced options > Startup Settings > Restart. Press 7 or F7 to "Disable driver signature enforcement".
Update FTK Imager: Older versions (e.g., 3.x or early 4.x) are more prone to these issues on Windows 11. Ensure you are using the latest version from the Exterro / AccessData website. Alternative Approaches
If the driver still won't start, consider these forensic alternatives:
WinFE (Windows Forensic Environment): Boot the target machine into a specialized WinFE environment where security features like Core Isolation are not active.
Magnet RAM Capture: A dedicated lightweight tool often used when FTK Imager’s memory driver fails.
Physical Write Blockers: If imaging a drive (rather than memory), use a hardware write blocker to bypass the need for software-level driver access to the physical disk.
Are you attempting a memory capture or a physical disk image when this error appears?
The "Could Not Start Driver" error in FTK Imager typically occurs during RAM captures
or live imaging, signaling that the application cannot load its kernel-level driver to access volatile memory or raw disk sectors 1. Root Causes Security Restrictions Memory Integrity
(Core Isolation) or Hypervisor-Protected Code Integrity (HVCI) often blocks third-party drivers that aren't compatible with Microsoft’s strict security standards. Permissions : The driver requires kernel access; failing to Run as Administrator will prevent it from loading. Architecture Mismatches : Running FTK Imager on ARM-based systems
(e.g., Apple M-series chips via Parallels) often fails because the driver is built for x86/x64 architectures and lacks ARM compatibility. Environment Constraints : Using FTK Imager in Windows PE
environments without the necessary runtime dependencies or .dll files can lead to driver initialization failures. Conflicting Software
: Existing instances of the driver or conflicting forensic tools (like older versions of FTK) may lock the necessary resources. 2. Immediate Solutions Administrator Privileges : Right-click the FTK Imager executable and select Run as Administrator to grant the necessary permissions for driver loading. Disable Memory Integrity Navigate to
Start > Settings > Privacy & security > Windows Security > Device Security Core isolation details and toggle Memory Integrity Restart your computer to apply the changes. Driver Signature Enforcement
: If the driver is unsigned or poorly signed, you may need to disable Driver Signature Enforcement through the Windows Advanced Startup menu. 3. Alternative Approaches for Memory Capture
If the error persists despite troubleshooting, use alternative tools that may have better compatibility with modern Windows security features: Magnet RAM Capture
: A lightweight tool frequently used when others fail in virtualized or ARM environments. : An open-source alternative for memory imaging.
: Part of the Comae-Toolkit, known for its reliability in diverse environments. 4. Best Practices for Live Forensics ftk imager could not start driver
The "Could Not Start Driver" error in FTK Imager usually happens when the application fails to load its low-level driver required for memory capture or direct physical disk access. This is often caused by Windows security features (like Core Isolation), permission issues, or stale driver services. 1. Disable Windows Core Isolation
Modern Windows security often blocks the FTK driver because it is perceived as a threat or uses outdated signing methods. Open Windows Security > Device Security. Click Core isolation details. Toggle Memory integrity to Off. Reboot your computer and try FTK Imager again. 2. Remove Stale Driver Services
If a previous installation or failed attempt left "ghost" services running, the new driver cannot start. Open Command Prompt as an Administrator. Run the following commands one by one: sc delete cbdisk sc delete cbdisk2 Reboot the system to clear the driver state. 3. Run as Administrator
FTK Imager requires high-level privileges to interact with physical hardware or system memory. Right-click the FTK Imager shortcut or .exe file. Select Run as administrator. 4. Virtual Machine Limitations
If you are running FTK Imager inside a VM (like Parallels or VMware on Apple Silicon), the software may struggle to start its driver because it cannot access the host hardware directly.
Workaround: Use a native Windows environment or ensure the VM software has "Nested Virtualization" enabled in its settings. 5. Trust "EldoS Corporation" during Install
FTK Imager relies on drivers from EldoS Corporation. If you declined this certificate during installation, the driver will not load. Reinstall FTK Imager.
When the security prompt appears, check "Always trust software from EldoS Corporation" and click Install. If these steps don't work, let me know: Are you trying to capture memory or image a physical disk? What version of FTK Imager are you using (e.g., 4.7.1)? Are you on Windows 11 or a specific VM environment?
| Step | Action |
|------|--------|
| ✅ | Run as Admin |
| ✅ | Enable Test Mode (bcdedit /set testsigning on) |
| ✅ | Disable Secure Boot in BIOS |
| ✅ | Disable antivirus temporarily |
| ✅ | Manually install driver via sc create |
After following these, FTK Imager should start without the driver error. If it still fails, your Windows version may be too new – consider using a Windows 10 LTSC or forensic VM (e.g., SIFT, CAINE, or PALADIN).
Informative Report: "FTK Imager Could Not Start Driver" Error
Introduction
FTK Imager is a popular digital forensics tool used for creating forensic images of drives and other storage devices. However, some users have reported encountering an error message stating "FTK Imager could not start driver." This report aims to provide an informative overview of the error, its possible causes, and potential solutions.
Error Description
The "FTK Imager could not start driver" error typically occurs when attempting to launch FTK Imager or during the imaging process. The error message may vary slightly depending on the version of FTK Imager being used, but the essence remains the same. This error prevents the user from creating forensic images using FTK Imager, which can hinder digital forensic investigations.
Possible Causes
After conducting research and analyzing user reports, several possible causes of the "FTK Imager could not start driver" error have been identified:
Solutions
To resolve the "FTK Imager could not start driver" error, try the following solutions:
Workarounds
If the above solutions do not resolve the issue, consider the following workarounds:
Conclusion
The "FTK Imager could not start driver" error can be frustrating and hinder digital forensic investigations. By understanding the possible causes and solutions outlined in this report, users can troubleshoot and potentially resolve the issue. If the problem persists, it may be necessary to seek additional support from FTK Imager's support team or engage with the digital forensics community for further assistance.
Recommendations
Future Research Directions
Further research is necessary to explore the root causes of the "FTK Imager could not start driver" error and to develop more effective solutions. Potential areas of investigation include:
"FTK Imager could not start driver" typically happens because Windows security features are blocking the tool's low-level access driver AccessData.sys Here are the most effective ways to fix it: 1. Disable Memory Integrity (Core Isolation) Modern Windows versions have a security feature called Memory Integrity
that blocks drivers it considers incompatible or unsigned. This is the most common culprit for FTK Imager driver failures. Windows Security Device security Core isolation details Memory Integrity Restart your computer and try launching FTK Imager again.
You can re-enable this after your forensic work if you want to maintain maximum system security. Microsoft Support 2. Run as Administrator
FTK Imager requires high-level permissions to interact with hardware and system memory. Right-click the FTK Imager icon Run as administrator
If this works, you can make it permanent by right-clicking the icon > Properties Compatibility tab > check Run this program as an administrator 3. Check for Driver Signature Issues
If you see an "Error Code 52," Windows cannot verify the driver's digital signature. You may need to reinstall FTK Imager using the latest version from the official Exterro website to ensure you have the most up-to-date, signed drivers. Alternatively, you can temporarily boot Windows into "Disable Driver Signature Enforcement"
mode via the Advanced Startup options, though this is less secure. 4. Check Antivirus/EDR Conflicts
Some security software (like CrowdStrike or Carbon Black) may block the AccessData
driver because it performs "suspicious" low-level disk operations.
Check your antivirus logs to see if the driver was quarantined.
for the FTK Imager installation folder and the specific driver file (usually found in C:\Program Files\AccessData\FTK Imager Are you trying to image a live system physical disk attached via a write-blocker? A driver can't load on this device - Microsoft Support
The Silent Witness: An Essay on the ‘FTK Imager Could Not Start Driver’ Error and the Fragility of Digital Forensics
In the realm of digital forensics, the investigator is often viewed as an omniscient entity—a technician capable of traversing the binary landscapes of a hard drive, resurrecting deleted ghosts, and piecing together the fragmented narrative of a digital crime. At the heart of this process lies the forensic image, a bit-for-bit replication of physical media that serves as the "body" of the evidence. For years, AccessData’s FTK Imager has been the scalpel of choice for this procedure, a trusted and ubiquitous tool in the examiner’s arsenal. Yet, there exists a moment of profound professional paralysis that every examiner eventually faces: the sudden appearance of the error message, "FTK Imager could not start driver."
This error is more than a mere software glitch; it is a collision between the rigid demands of forensic protocol and the chaotic, evolving architecture of modern computing. To understand the gravity of this error is to understand the precarious nature of digital evidence itself. When FTK Imager fails to initialize its kernel-level driver, the pipeline between the physical evidence and the forensic analyst is severed. The investigation halts. The "body" becomes inaccessible. This essay explores the technical anatomy of this failure, the tension between security and utility, and the existential questions it raises regarding the reliability of forensic tools. Open Command Prompt as Administrator and run: sc
The Kernel’s Gatekeeper
To comprehend why FTK Imager fails to start its driver, one must first understand the terrain in which it operates. Modern operating systems, particularly Windows, operate on a tiered privilege model. The "user mode" is where applications like Word or Chrome run—sandboxed environments where mistakes rarely crash the system. Below this lies the "kernel mode," the deep substratum where hardware meets software. This is the domain of the operating system’s soul, where a single error can result in the catastrophic "Blue Screen of Death."
FTK Imager requires access to this kernel mode to bypass the operating system’s file system locks and read the raw sectors of a drive. To do this, it must load a "driver"—a piece of software that acts as a bridge between the application and the hardware. The error "could not start driver" is effectively a refusal of entry at the gate. The operating system, acting as a sentinel, looks at the driver FTK is attempting to load and bars it from entering the kernel.
This refusal is rarely arbitrary. It is the result of the escalating "arms race" between malware and system integrity. Drivers operate with god-like privileges; historically, malware has abused drivers to inject code into the system kernel. In response, Microsoft implemented increasingly draconian security measures, most notably Driver Signature Enforcement (DSE) and the advent of Virtualization-Based Security (VBS) in Windows 10 and 11. These technologies demand that all drivers be cryptographically signed and verified. If FTK Imager utilizes an older driver, a driver with an expired certificate, or a driver flagged by Windows Defender as "suspicious" (a false positive), the system prevents the load. The tool is rendered blind.
The Forensic Paradox: Security vs. Methodology
This failure illuminates a fundamental paradox in digital forensics. The investigator relies on the integrity of the operating system to run their tools, yet the OS is increasingly designed to block the very low-level interactions those tools require. The error message is the friction point between the philosophy of "secure by design" and the philosophy of "investigate by design."
When the driver fails to load, the investigator is presented with a dilemma that borders on the ethical. The "correct" forensic methodology dictates that evidence should not be altered. However, to bypass the driver error, an examiner might be forced to disable security features like Driver Signature Enforcement or temporarily deactivate antivirus protections. In doing so, the investigator must alter the state of the evidence host machine. They must lower the drawbridge, potentially exposing the system to instability or external threats, just to gain access. This creates a procedural "catch-22": one must technically compromise the system's security posture to validate the integrity of the evidence within it.
Furthermore, this error highlights the issue of tool reliance. The "black box" nature of forensic software suggests that as long as the tool is certified, the output is valid. But when the tool fails due to an underlying OS update—such as a Windows update that introduces a new Hypervisor-Protected Code Integrity (HVCI) policy—it reveals that forensic tools are not static instruments. They are brittle dependencies in a shifting ecosystem. The "FTK Imager could not start driver" error forces the examiner to acknowledge that their scalpel is not immune to the rust of obsolescence.
The Tyranny of the Right-Click
Beyond the technical constraints, this error serves as a critique of the "push-button" mentality that can pervade the field. In the early days of computing, digital forensics was a discipline requiring deep knowledge of file systems and hex code. Today, graphical user interfaces (GUIs) have abstracted this complexity, allowing for "point-and-click" forensics.
The driver error shatters this abstraction. It forces the examiner out of the role of a passive observer and back into the role of a troub
"FTK Imager could not start driver" typically occurs when the application lacks the necessary permissions to interact with the system's kernel or when Windows security features block its low-level drivers
. This is most common during memory captures or physical drive imaging. Primary Solutions Run as Administrator : Right-click the FTK Imager executable and select Run as Administrator
. This is required because the tool must load a kernel-mode driver to access RAM and physical disks. Disable "Memory Integrity" (Core Isolation)
: Windows 10 and 11 have a security feature called Memory Integrity that may block the FTK driver from loading. Windows Security Device Security Core isolation details Memory Integrity and restart your computer. Disable Driver Signature Enforcement
: If the driver is flagged as unsigned or its certificate has been revoked, you may need to disable enforcement. Restart Windows into Advanced Startup
(Troubleshoot > Advanced options > Startup Settings) and select ("Disable driver signature enforcement"). Use an Older or Different Version
: Users have reported that switching from "Lite" to the full portable version (e.g., version 4.3 or later) can bypass certificate issues. Common Triggers & Troubleshooting Virtual Environments
: This error frequently occurs in virtual machines (like Parallels on Apple Silicon M1/M2 Macs) because the virtualization engine may not support the specific chipset features the FTK memory driver requires. Missing Dependencies
: If running from a USB (Portable/Lite version), ensure all folder contents were copied. Newer 64-bit versions may require Microsoft Foundation Class (MFC) add-on files to be present on the target machine. Command Line Bypass
: If the GUI continues to fail, try running the FTK CLI (Command Line Interface) from an Administrative Command Prompt Alternative Tools
If FTK Imager consistently fails to load its driver on a specific system, consider these forensic alternatives: Magnet RAM Capture for memory imaging. Arsenal Recon Image Mounter for mounting disk images. Paladin (Bootable Linux) to image the drive outside of the Windows environment. Forensic Focus Are you attempting a memory capture physical disk image when this error appears?
The error "FTK Imager could not start driver" typically occurs because the software lacks sufficient permissions or is encountering a conflict with Windows security features like Core Isolation. 🛠️ Immediate Solutions If you are seeing this error, try these fixes in order:
Run as Administrator: Right-click the FTK Imager icon and select Run as Administrator. The driver requires elevated privileges to access physical hardware.
Disable Memory Integrity: Go to Windows Security > Device Security > Core Isolation details and toggle Memory Integrity to Off. Restart your computer and try again.
Check Antivirus: Some security suites block the low-level driver FTK uses to read raw disk data. Temporarily disable your antivirus to test.
Reinstall the Application: Corrupted installation files often cause driver failures. Uninstall, download the latest version from the Exterro website, and reinstall. 🔍 Why This Happens
FTK Imager is a forensic tool designed to create "bit-for-bit" copies of hard drives. To do this, it installs a specific kernel-mode driver to bypass standard Windows file protections. Common Conflict Points
Virtual Machines: Running FTK Imager inside a VM (like VMware or VirtualBox) can prevent the driver from interacting correctly with physical hardware.
Driver Signature Enforcement: Newer versions of Windows (10 and 11) have strict requirements for signed drivers. If the FTK driver is outdated, Windows may block it from loading.
Corrupt Registry: Leftover entries from previous versions can conflict with new installations. 💬 Community Perspectives
Users often encounter this when transitioning to newer operating systems or working with damaged hardware. Troubleshooting Experiences
“Forensic analysis should only be performed on a workstation on which one has full administrative rights or one will run into the problems...” Reddit · r/computerforensics
“If FTK is failing try different version... Certain standalone generations will simply not permit an incomplete or corrupted image set to be loaded.” Reddit · r/computerforensics · 4 years ago Digital Forensics | FTK Imager - Exterro
When FTK Imager fails with a "could not start driver" error, it typically means the application is having trouble communicating with the system's low-level disk access components. This often stems from modern Windows security features like Memory Integrity (Core Isolation), which can block third-party drivers from loading to prevent kernel-level attacks. Common Fixes
Run as Administrator: Right-click the FTK Imager shortcut and select Run as Administrator to ensure it has the necessary permissions to interface with system drivers.
Disable Memory Integrity: If you are using Windows 10 or 11, the Core Isolation feature might be blocking the driver. Open Windows Security. Go to Device security > Core isolation details. Toggle Memory integrity to Off and restart your computer.
Reinstall the Application: Corrupted installation files or registry entries can cause startup failures. Download the latest stable version from the official Exterro website and perform a fresh install.
Check Hardware Drivers: If you are using a write-blocker or specific SSD, ensure the latest manufacturer drivers for that hardware are installed on your workstation. Troubleshooting Physical Hardware
If the error occurs specifically when trying to mount or image a physical drive, it could indicate a hardware-level failure. Check if it exists
Verify Connection: Check the USB cable, write-blocker, or port to ensure a stable connection.
Check SMART Status: Use a tool to check the drive’s health; failing drives with bad sectors often cause I/O errors that manifest as driver or startup failures in forensic tools.
Alternative Tools: If FTK Imager continues to fail due to a dying drive, consider using a Linux-based tool like ddrescue, which is better at handling hardware read errors.
Are you seeing this error when opening the app or after you've already selected a specific drive to image? FTK Imager 4.7 - Exterro
The error "FTK Imager could not start driver" typically occurs when the application lacks the necessary permissions or system resources to load its low-level hardware access driver. This driver is essential for FTK Imager to interact directly with physical drives, memory, and protected system files. Common Causes
Insufficient Privileges: Running the program as a standard user instead of an administrator.
Driver Blockage: Windows or third-party antivirus software preventing the driver from loading.
Corrupt Installation: Missing or damaged driver files within the FTK Imager directory.
Resource Conflicts: Another forensic tool or system process locking access to the driver interface.
Compatibility Issues: Running older versions of FTK Imager on modern operating systems like Windows 11. Step-by-Step Solutions 1. Run as Administrator
This is the most frequent fix. FTK Imager requires "Ring 0" access to capture physical disks, which standard user accounts cannot provide. Right-click the FTK Imager shortcut or executable. Select Run as administrator. Click Yes on the User Account Control (UAC) prompt. 2. Disable Antivirus or EDR
Many Endpoint Detection and Response (EDR) tools flag the FTK driver as suspicious because it behaves like a rootkit to gain direct hardware access.
Temporarily disable Windows Defender or your third-party antivirus. Try launching FTK Imager again.
If it works, add the FTK Imager installation folder to your antivirus Exclusion List. 3. Reinstall FTK Imager
If the driver file (.sys) is missing or corrupted, a clean installation is required.
Uninstall the current version via Control Panel > Programs and Features.
Delete any remaining folders in C:\Program Files\AccessData.
Download the latest version from the official Exterro website. Install the software using administrative rights. 4. Use the Lite (Portable) Version
If the installed version continues to fail, the Portable (Lite) version often bypasses registry-related driver issues. Download the FTK Imager Lite ZIP file. Extract the contents to a folder or USB drive. Right-click FTK Imager.exe and select Run as administrator. 5. Check Windows Core Isolation
Windows "Memory Integrity" features can block drivers that aren't digitally signed to modern standards. Go to Windows Security > Device Security. Click Core isolation details.
Toggle Memory integrity to Off and restart your computer (Note: This reduces system security). 💡 Pro Tip
If you are performing a live acquisition, always ensure no other forensic imaging tools are running simultaneously, as they may compete for the same driver resources. To help you get back to your investigation, tell me: Which Windows version are you using? Are you using the installed or portable version? Do you have local admin rights on the machine?
The "FTK Imager could not start driver" error typically indicates that the software cannot communicate with the system's storage drivers, often due to missing permissions or version incompatibilities with modern Windows security features. Troubleshooting "FTK Imager Could Not Start Driver"
The error message "Could not start driver" is a common roadblock when attempting to capture physical memory or perform forensic imaging of a drive. Below are the most effective ways to resolve it. 1. Run as Administrator
FTK Imager requires low-level access to hardware drivers to perform its forensic tasks. This level of access is restricted by standard Windows permissions.
The Fix: Right-click the FTK Imager executable or shortcut and select Run as Administrator. This is often the only step needed to allow the driver to initialize. 2. Switch to a Different Version (Lite vs. Full/Portable)
Many users encounter this specific error when using FTK Imager Lite on Windows 10 or 11 machines due to revoked or expired signing certificates.
The Fix: Upgrade to a more recent version, such as FTK Imager 4.3 or higher. If you are using the Lite version, try the standard FTK Imager installation or the portable 64-bit version. 3. Check for Missing Dependencies
If you are running FTK Imager from a USB drive (portable mode), it may fail because it cannot find the necessary Microsoft Visual C++ redistributable files on the target machine.
The Fix: Ensure the following are present in your portable folder: Microsoft Foundation Class (MFC) files.
Necessary DLLs from the Microsoft Visual C++ Redistributable. 4. Address Windows Security & Driver Signing
Windows may block the driver if it perceives it as a security risk or if the driver's certificate is no longer trusted.
The Fix: You can try bypassing certificate verification by launching the tool through an Administrator Command Prompt.
Note: For advanced troubleshooting on systems where the driver causes crashes (BSOD), you may need to use the Windows Driver Verifier to see if another driver is conflicting with FTK. 5. Hardware & Connection Issues
If the driver starts but cannot "see" the drive, the issue might be physical.
The Fix: Verify the connection to the computer, check the write blocker (if used), and ensure the disk is properly attached to the PC. If the drive is failing, it may time out during driver initialization. Next StepsIf these steps don't work, let me know: Your Windows version (e.g., Windows 11 22H2)
The exact version of FTK Imager you're using (e.g., Lite 3.1.1 or 4.7)
I can then provide more version-specific registry or compatibility fixes.
Important: Before performing any of these steps, ensure you have legally obtained access and appropriate authorization to work with the forensic image.