Question
How do I increase the level of debug logging in FTK?
Note: This is separate from Capture Processing Engine Debug/Error Logs
Answer
- Close FTK
- Open Registry Editor (regedit) as Administrator
- Navigate to the key "HKLM\SOFTWARE\AccessData\Products\Forensic Toolkit\<version>"
- Create a new DWORD value called "log_debug_and_trace" with the value of 1
- The additional logging will be at "%ProgramData%\AccessData\Products\Forensic Toolkit\<version>\FTK_log_debug.txt"
Overview
By default, the log at "%ProgramData%\AccessData\Products\Forensic Toolkit\<version>\FTK_log.txt" captures INFO and ERROR level messages only. The above steps add an additional log to capture DEBUG and TRACE messages.