Simply using an account with administrator rights is often not enough due to User Account Control (UAC). Close completely. Right-click the FTK Imager.exe shortcut or binary. Select Run as administrator . Try mounting or adding the evidence item again.
AccessData (now Exterro) releases updates to keep up with Windows builds.
The error message "FTK Imager could not start driver new" typically occurs when a user attempts to launch FTK Imager or create a new forensic image. The error message indicates that the tool is unable to start a required driver, which is necessary for the imaging process. ftk imager could not start driver new
Download the latest version of FTK Imager directly from the official Exterro website. Install the application and attempt the acquisition again. Alternative Forensic Workarounds
It sounds simple, but User Account Control (UAC) frequently blocks the driver from initializing. Simply using an account with administrator rights is
Right-click the or the FTK Imager.exe file. Select Run as administrator . Click Yes on the User Account Control (UAC) prompt. To permanently set this privilege: Right-click the executable and select Properties . Go to the Compatibility tab. Check the box for Run this program as an administrator . Click Apply and OK . 2. Disable Core Isolation / Memory Integrity
Create a "portable" version of FTK Imager on a USB stick from a computer where it works properly, then run it on the target machine, bypassing formal installation/driver registration. 4. Summary Table of Solutions Probable Cause "Could not start driver" Signature violation Disable Signature Enforcement "Driver failed" on startup Conflict with AV Add exclusion to Windows Defender Mounting fails Old driver residue Delete .sys files in System32 General error (New Win11) VBS Memory Integrity Disable Core Isolation/VBS Conclusion Select Run as administrator
Create an targeting the directory path where your tool resides (e.g., C:\Program Files\AccessData\FTK Imager\ or your specific forensic USB root folder). Retest the physical imaging or memory collection routine. Alternative Forensic Approaches
This guide is designed to be followed in order, progressing from the most common and effective solutions to more advanced and thorough fixes.
Hold down the key while clicking Restart in the Windows Power menu.