: Modern Windows environments employ Hypervisor-Protected Code Integrity (HVCI) and Driver Signature Enforcement. If an older version of FTK Imager attempts to load an outdated third-party virtual storage driver, Windows blocks the kernel injection.
Locate the FTK Imager shortcut or the FTK Imager.exe file in your installation directory. Right-click on the file and select . If a User Account Control (UAC) prompt appears, click Yes . To ensure it always runs with high privileges: Right-click the shortcut and select Properties . Go to the Shortcut or Compatibility tab.
Install the application, ensuring you grant administrative permissions during setup.
[FTK Imager Execution] │ ├──► Failure 1: Windows Kernel Block (Driver Signature Enforcement / HVCI) ├──► Failure 2: Lacking Local Administrator Rights ├──► Failure 3: Missing Visual C++ & MFC DLL Files (Portable USB setups) └──► Failure 4: Corrupt EldoS Virtual Storage Driver Registry Keys ftk imager could not start driver new
If a recent Windows update flags the underlying system driver as untrusted, you can temporarily disable driver enforcement to complete your data acquisition phase.
If you just need to view an image (not acquire a new one):
How to Fix "FTK Imager Could Not Start Driver" Error on Windows Right-click on the file and select
Simply using an account with administrator rights is often not enough due to User Account Control (UAC). Close completely. Right-click the FTK Imager.exe shortcut or binary. Select Run as administrator . Try mounting or adding the evidence item again.
Hold down the key while clicking Restart in the Windows Start Menu.
Right-click the conflicting driver and select , then restart your computer. 4. Switch to FTK Imager Lite Go to the Shortcut or Compatibility tab
Click on the User Account Control (UAC) prompt to allow the application full hardware access. 2. Install Missing Visual C++ Redistributables
If you are still having trouble after these steps, it is highly recommended to reach out to the Exterro support team for the latest driver patch.
Some users report that the error points explicitly to "driver new" rather than a named driver like ewf . This often indicates that FTK Imager is failing to call the StartService Windows API for a driver it just dynamically generated.
: Ensure all required Microsoft Foundation Class (MFC) and Visual C++ Redistributable files are present in the application folder, especially when running from removable media .