The "Could Not Start Driver" error in FTK Imager typically occurs when the software lacks the necessary permissions to access hardware or when system security features block the loading of its kernel-mode drivers . Immediate Fixes
Run as Administrator: Right-click the FTK Imager shortcut and select Run as administrator. High-level forensic tasks like memory imaging or physical drive access require elevated system privileges .
Disable Memory Integrity: In Windows Security, go to Device Security > Core Isolation. Toggle Memory Integrity to Off and restart. This feature often blocks third-party drivers used by forensic tools .
Check Architecture: If you are on an ARM-based machine (like an M1/M2 Mac running a VM), FTK Imager's x86/x64 drivers may not be compatible . Advanced Troubleshooting Modify Registry for Permissions:
Open regedit and navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System.
Create a new DWORD (32-bit) Value named EnableLinkedConnections . Set its value to 1 and restart your computer.
Install MFC Dependencies: If using a 64-bit version (3.4.3 or higher) on a fresh system, ensure Microsoft Foundation Class (MFC) add-on files are installed, as they are required for the drivers to initialize .
Verify Installation: Corrupted installation files can prevent drivers from launching. Download a fresh copy of FTK Imager and perform a clean reinstall .
💡 Quick Tip: If you are trying to capture memory on a Windows 11 VM, the virtualization engine may not support the specific chipset features FTK Imager requires . If you'd like to troubleshoot further, let me know: Are you performing a memory capture or a disk image?
What operating system and hardware (Intel/AMD or ARM) are you using? Is this a physical machine or a virtual machine (VM)?
The "Could Not Start Driver" error in FTK Imager commonly occurs during memory capture on Windows 10/11 due to Memory Integrity (HVCI) settings, driver signature enforcement, or ARM-based hardware incompatibilities. Troubleshooting involves disabling Memory Integrity in Windows Security, running the application as an administrator, or utilizing alternative tools like Magnet RAM Capture or Paladin for memory acquisition. Read the full discussion on troubleshooting this error in this Reddit thread Microsoft Support
The error "FTK Imager could not start driver" typically occurs during memory capture or physical drive acquisition on modern operating systems. It is often a conflict between the tool's legacy drivers and newer Windows security features or hardware architectures. Common Fixes for "Could Not Start Driver" If you are seeing this error, try these proven workarounds:
Run as Administrator: This is the most common requirement. Right-click the FTK Imager.exe and select Run as Administrator to ensure the tool has permission to load kernel-level drivers.
Use Admin Command Prompt: Launch a Command Prompt as an administrator and run the FTK Imager executable (especially for FTK Imager Lite) directly from the command line.
Disable Driver Signature Enforcement: Modern Windows (10/11) may block the driver because its signing certificate was revoked or is considered legacy. You can temporarily disable this through the Advanced Startup menu to see if the driver loads successfully.
Check ARM vs. x64 Architecture: If you are running Windows 11 on an ARM-based machine (like an M1/M2/M3 Mac via Parallels), FTK Imager's x64 drivers may fail to load because they are not compatible with the ARM architecture. Review of FTK Imager (Exterro)
FTK Imager remains a staple in digital forensics due to its price (free) and reliability for standard imaging tasks, but it shows its age in modern environments.
Versatility: It excels at creating Physical and Logical Images in various formats including E01, Raw (dd), and AD1.
Reliability vs. Speed: While highly trusted, recent benchmarks show it is significantly slower than newer tools like OSForensics or X-Ways Imager, especially when compression is enabled. ftk imager could not start driver new
User Interface: The UI is considered outdated and simplistic, which is great for beginners but lacks the advanced features found in paid forensic suites.
Stability Issues: Users have reported "white screen" freezes and serious performance drops when verifying images over a network or dealing with potentially corrupted partition tables. Alternative Tools If the driver error persists, consider these alternatives:
Magnet Acquire: A free, more modern imaging tool that often handles newer Windows drivers better.
Sumuri PALADIN: A bootable Linux environment that bypasses Windows driver issues entirely to image drives.
KAPE: While not a bit-for-bit imager, it is superior for rapid logical evidence collection.
The error "FTK Imager could not start driver" typically occurs because of Windows security features, insufficient permissions, or missing dependencies required for the tool to interact with low-level disk hardware. Troubleshooting "FTK Imager Could Not Start Driver" 1. Disable Windows Memory Integrity (Core Isolation)
On Windows 10 and 11, a feature called Memory Integrity (part of Core Isolation) often blocks older or non-WHQL drivers from loading for security.
Open Windows Security > Device Security > Core isolation details. Toggle Memory Integrity to Off. Restart your computer and try launching FTK Imager again. 2. Run with Elevated Administrator Permissions
FTK Imager requires "Administrative" privileges to mount its driver and access physical drives directly.
Right-click the FTK Imager icon and select Run as administrator.
If you are using FTK Imager Lite, try launching it through an Administrative Command Prompt. 3. Clear Legacy Drivers
If an older version of the driver is stuck or corrupted, you may need to manually delete it using a command prompt with administrator rights: Open Command Prompt (Admin). Type sc delete cbdisk and press Enter. Type sc delete cbdisk2 and press Enter.
Reboot the system to allow FTK Imager to attempt a clean driver start on its next launch. 4. Address Missing Dependencies
Newer versions of FTK Imager (such as v4.5.0 and above) may require specific Microsoft Visual C++ Redistributable files or Microsoft Foundation Class (MFC) files to function correctly, especially when running from a portable USB drive.
Ensure you have the latest Visual C++ Redistributable for Visual Studio installed on the host machine.
If running a "Lite" or portable version, ensure the entire installation folder—including all .dll files—was copied correctly. 5. Reinstall or Replace the Executable If the error persists, the installation might be corrupted. [SOLVED] How To Fix FTK Imager.exe Errors - Solvusoft
The error "FTK Imager could not start driver" typically occurs when the application lacks the necessary administrative permissions or when Windows security features prevent the kernel-mode driver from loading Quick Solutions Run as Administrator
: Right-click the FTK Imager shortcut or executable and select Run as Administrator The "Could Not Start Driver" error in FTK
. The driver requires elevated privileges to interact with hardware-level data. Check for Portable vs. Installed
: If you are using the portable version from a USB drive, ensure the drive is not write-protected. Sometimes, the installed version is more stable for driver initialization. Disable Secure Boot : On some modern systems, UEFI Secure Boot
prevents unsigned or third-party drivers from loading. Temporarily disabling this in your BIOS/UEFI settings can resolve the issue. Troubleshooting the "New" Driver Error
The "new" driver error specifically refers to FTK Imager's attempt to load its memory or disk acquisition driver. Antivirus/EDR Interference
: Security software like Windows Defender or CrowdStrike may flag the driver loading as suspicious behavior. Check your quarantine or "blocked actions" logs and add an exclusion for FTK Imager.exe Memory Integrity (VBS) : In Windows 10 and 11, the Core Isolation > Memory Integrity feature can block drivers that it deems incompatible. Windows Security Device Security Core isolation details Memory integrity and restart your computer. Compatibility Mode : Right-click the executable, go to Properties Compatibility , and try running the program in compatibility mode for Windows 10 Alternative Tools
If the driver continues to fail, you can use these alternative forensic imaging tools: Magnet RAM Capture
: Excellent for memory imaging if the FTK driver won't start. KAPE (Kroll Artifact Parser and Extractor) : For triaging files without needing a full physical image.
: A popular open-source alternative (primarily for Linux-based forensic environments). or check your BIOS settings AI responses may include mistakes. Learn more
The "Could Not Start Driver" error in FTK Imager typically occurs when the application lacks the necessary permissions or when Windows security features block its specialized forensic drivers . Quick Fixes
Run as Administrator: This is the most common solution . Right-click the FTK Imager executable and select Run as Administrator to ensure it has the system-level permissions required to load its drivers .
Use Command Prompt: If the standard interface fails, open a Command Prompt as Administrator and launch the application directly from there . This often bypasses revoked certificate issues or OS blocks .
Disable Memory Integrity (Core Isolation): Modern Windows security can block drivers it deems incompatible . Go to Windows Security > Device Security > Core Isolation and toggle Memory Integrity to Off . Troubleshooting Specific Scenarios
ARM-based Hardware: If you are using a device with an ARM processor (like an M1/M2 Mac running Windows via Parallels), FTK Imager's x64 drivers may fail to start because they are not compatible with ARM architecture .
Portable/Lite Version Issues: If you are running the "Lite" version from a USB drive, try switching to the full portable version (v4.3 or higher) .
Missing Dependencies: Ensure all required Microsoft Foundation Class (MFC) and Visual C++ Redistributable files are present in the application folder, especially when running from removable media .
Alternative Tools: If the error persists, consider using other free forensic imaging tools like Magnet Acquire or EnCase Imager .
Are you running FTK Imager on a physical machine or inside a virtual environment?
Title: Solved: How to Fix "FTK Imager Could Not Start Driver (New)" Error "Could not start driver (new)
If you work in digital forensics or incident response, FTK Imager is likely one of the most essential tools in your arsenal. It’s the go-to standard for acquiring images, hashing files, and previewing data.
However, there are few things more frustrating than firing up FTK Imager to image a drive, only to be greeted by the dreaded error message:
"Could not start driver (new)."
This error effectively renders the software useless for forensic acquisition. But don't panic. This is a common issue, usually related to Windows security permissions, outdated drivers, or service conflicts.
In this post, we will walk through the most effective methods to resolve this error and get you back to imaging.
If you just need to view an image (not acquire a new one):
If none of the above work, provide:
That will help narrow down the fix.
Kernel drivers are a common target for rootkits. Many security products—especially McAfee, Symantec, CrowdStrike, or modern Windows Defender—will automatically block the installation of unknown or rarely seen drivers, even if they are legitimate.
If you need a permanent fix for FTK Imager on your forensic workstation:
Note: Microsoft recommends keeping this on for daily driving, but forensic workstations often disable it for legacy tool compatibility.
The driver file (.sys) must be extracted from the FTK Imager executable or present in the installation directory. If your antivirus, Windows Defender, or cleanup script deleted it, the driver cannot start.
If FTK Imager (or the system) crashed previously, a stale driver file may remain loaded in memory or orphaned in the driver store. When the new instance tries to start the driver, it conflicts with the zombie process.
Some users report that the error points explicitly to "driver new" rather than a named driver like ewf. This often indicates that FTK Imager is failing to call the StartService Windows API for a driver it just dynamically generated.
In this specific scenario, the issue frequently relates to Temp folder permissions. FTK Imager writes a temporary .sys file to %TEMP%\FTK Imager\. If that folder is compressed, encrypted, or located on a network drive, the driver cannot start.
Fix:
If Test Mode didn't work, you can try disabling driver signature enforcement entirely during the boot process. This allows any driver to load, regardless of its signature.