Media Categorization is a method to identify the delicate content and help reviewers work easily and safely with sensitive images.


Steps to implement and use this feature with Central

Step 1: Make sure KFF/Cassandra is installed and connected to FTK

  • In order to use the Media Categorization Feature you need to have requested the KFF license.
  • You can find the guide here


Step 2: Go to 'System Management' to enable Media Category on a global level

  • Under Case defaults select the media categorization region

  • Keep in mind that once the region has been selected it is not possible to change it (Please contact support if you require it to be changed, since it requires a modification in the Data Base)
  • Important:  At the current moment using the "Region_US" the media does not get categorized yet. Please select UK region until the functionality has been implemented.
  • If you define the UK region you can only use the FTK Lab to import the necessary file later on.


Step 3: Download the known hash sets with the defined categories in .json format

  • Source 1: Project VIC:  projectvic.org/get-hashes - only available for law enforcement.
  • Source 2: NIST : the Child Abuse Image Database is available to everyone to download.
  • The .zip file contains several .json files for different file types e.g. AVI,WAV,MOV,MPG etc.
  • Save the .json files on your drive.


Step 4: Import the appropriate hash sets using KFF

  • Option 1: KFF Import Utility (Attention: It works only with US-region, therefore it is currently not supported).



  • Option 2 (Recommended): FTK Lab/Enterprise: From the main Menu - 'Manage'- 'KFF' - Import the .json file to an existing KFF group.

  • You can also follow this guide for detailed instructions.
  • Note: You need to select the extension that you need - in our case .json


Step 5: Process the evidence using the KFF option

  • Option 1: Do the KFF processing at the very beginning when creating the case.

  • Option 2: Do the KFF processing as an additional analysis after the case has already been created.

  • Important: In both cases make sure you select the following has been selected:
    - MD5 and SHA1 Hashes 
    - KFF - Project VIC. 
    Note: The dropdown menu next to KFF will initially be empty. In order to make it sync with the KFF server please uncheck and then check the KFF option again.
    - It is recommended to also select 'Create Thumbnails for Graphics' in order to make use of the pixelation. The color coding of the individual pictures works only when "Thumbnail View" has been selected within the case.



Step 6: Initiate Media Category on a per-case level

  • Go to the case list
  • Click on the three dots on a specific case (on the right end).
  • Select 'Initiate Media Category' then you will see the default Media Categories being loaded:

  • Select "Merge KFF Categories"
  • Click 'Save' and then 'Close'


Step 7: Check the results

  • Go to the case list.
  • Select your case.
  • Go to "Enter Review".
  • In the Thumbnail view, please select: 'Pixelate Categorized Images'


  • The different categories should be framed in different colors based on the category code.
  • Media Categorization automatically created bookmarks
  • Note: A user can use bookmarks to mark items manually as well using the Media Categorization shortcuts.