Question

How do I increase the level of debug logging in FTK?

Note: This is separate from Processing Engine logging

 

Answer

  1. Close FTK
  2. Open Registry Editor (regedit) as Administrator
  3. Navigate to the key "HKLM\SOFTWARE\AccessData\Products\Forensic Toolkit\<version>"
  4. Create a new DWORD value called "log_debug_and_trace" with the value of 1
  5. The additional logging will be at "%ProgramData%\AccessData\Products\Forensic Toolkit\<version>\FTK_log_debug.txt"

 

Overview

By default, the log at "%ProgramData%\AccessData\Products\Forensic Toolkit\<version>\FTK_log.txt" captures INFO and ERROR level messages only.  The above steps add an additional log to capture DEBUG and TRACE messages.