My main use case for Exterro is to conduct forensics about fraud in payments and identify fraud in transactions while supporting federal policies in Brazil regarding fraudsters. It helps me identify fraud in notebooks, laptops, and cellphones. I used Exterro in a fraud investigation about credit cards to identify the 'Tarja' or chip in Brazil, while in the United States, we identify with the credit card only. I used Exterro to identify the extension for the archive and the file in the possession of the user, which made it much easier to identify the credit card number and the USB adapter. I later used Exterro for forensics on the fraudster's hard drive. I use Exterro to identify fraud in mobile scenarios only, and in enterprise, I identify fraud when people use their laptops for fraud in the company. My primary use of Exterro is to identify credit card fraud.
Cyber Forensic Specialist at a tech services company with 1,001-5,000 employees
Real User
Top 20
Jun 27, 2026
My main use case for Exterro is to parse data whenever there is an incident in a company, so I often use Exterro to process the data and parse the artifact to find the relevant data according to the incident that has occurred. A specific example of how I have used Exterro in a real incident involved an insider threat where an employee copied important data to a pen drive. With the help of Exterro, I parsed the image of that particular machine, and by correlating the USB artifact being used at that time and the activity of the logins that accessed that system, I correlated the USB timelines and other artifacts, such as MPAS and SIMCAS, as well as the use of the USB drive at that time, and accordingly set up the correlation of the timeline, proving that the employee copied the important file from the computer itself.
As a forensic science student, I can realistically use Exterro for all of my academic work. It is very easy to understand and manage digital evidence. I use it for storage, tagging, and organized investigations, primarily to study digital evidence management and workflow using Exterro. I try to incorporate what I have learned in my regular classes and apply it using Exterro, which helps me manage and understand the concepts better. I use Exterro for e-discovery, forensic and legal forensics, mobile evidence handling, and cyber crime investigation workflows. Comparing Exterro with Autopsy and FTK Imager, the UI, workflow, and reporting usability are much easier, which is why I use it.
Teaching Fellow In Digital Forensics And Cybersecurity at a university with 5,001-10,000 employees
Real User
Top 20
May 23, 2026
I have been working in my current job for the last eight to ten months, and I have been in the cybersecurity field for the last three years. I have been using Exterro for the last one year. I typically use Exterro to teach students about FTK Imager, which is one of its products, and I teach students about these kinds of tools that are essential for digital forensics. We provide students with FTK Imager as a tool to image certain products when we want them to learn about imaging, and at that particular moment, we use it mainly to image hard disks and similar devices. I also use Exterro to provide an assignment that helps students learn about the different types of images and what kind of images can be worked with.
My main use case for Exterro is conducting forensic analysis with email. After gathering the emails of a company that had a data leak, I used Exterro to identify the central point of this leak and the concatenation of the data on a platform.In addition to forensic analysis with email, Exterro helps me with various types of cases, both more complex cases and post-mortem forensic cases. In all the cases I work on, I use it in my day-to-day work, whether for card data leaks or for validating forensic analyses involving image data.
Assistant Professor of Cybersecurity and Digital Forensics at a university with 1,001-5,000 employees
Real User
Top 10
May 21, 2026
I have used Exterro at a couple of instances. I've used Exterro throughout my internships as a digital forensic consultant, as well as using Exterro, specifically the FTK Imager and FTK Toolkit, to teach my students in the digital forensics class I teach. I mostly use Exterro for teaching. I usually give my students labs with digital forensics labs where we start off with trying to image the disk at hand, and that's where I use FTK Imager. I usually teach them about hashes, how to image, how to get registry, or even how to analyze memory by taking an image of the memory. Then we go on to analyzing the disk image to find deleted files, recovering artifacts like browser history, emails, and registry keys. The whole process is divided into several labs that I give to my students. Exterro has been the very first tool I usually introduce to my students. Most of the time, my students come back and say that it's very intuitive. Since it's been the very first tool that they get introduced to in the class, it usually leaves a very lasting impact on them. Using Exterro in class has been really helpful in getting students to understand the fundamentals. I use Exterro as a live teaching tool rather than having a simulated environment. Students actually go through and use Exterro with real forensic disk images and practice the same workflow as a practicing examiner would. I know this because I actually used Exterro for my internship. As a digital forensic consultant, we used to analyze all sorts of cases using Exterro, the FTK Toolkit, and the FTK Imager. I try to use the same workflow and the same methodology to teach students who are going to become digital forensic analysts using Exterro. This has been one of the most heavily used cases for Exterro.
We use Exterro as a glorified notification system. It was used by the Office of General Counsel and Debt Collections Group to notify employees that they needed to preserve emails or records, or whatever information they had that pertains to cases where we're suing members, for example. Legal hold matters. It wasn't that we were necessarily using the tool for preservation of any kind. It was just that the old process was basically done through email — there was no structure behind it. That was kind of the main purpose for bringing Exterro in. We are using a SaaS version of Exterro. As far as increasing the usage, that might be TBD. We might expand and maybe other groups might use the tool. But for now, it's just mainly that first group, the Office of General Counsel, and the second group, Debt Collections.
Exterro drives efficiency in legal and compliance operations by offering comprehensive e-discovery and data privacy management features that meet the demands of a digital-first world.Exterro provides a robust set of tools designed to streamline legal processes, mitigate risks, and ensure regulatory compliance. Its powerful capabilities include e-discovery, data mapping, and incident response planning, making it suitable for industries dealing with sensitive data. With Exterro, organizations...
My main use case for Exterro is to conduct forensics about fraud in payments and identify fraud in transactions while supporting federal policies in Brazil regarding fraudsters. It helps me identify fraud in notebooks, laptops, and cellphones. I used Exterro in a fraud investigation about credit cards to identify the 'Tarja' or chip in Brazil, while in the United States, we identify with the credit card only. I used Exterro to identify the extension for the archive and the file in the possession of the user, which made it much easier to identify the credit card number and the USB adapter. I later used Exterro for forensics on the fraudster's hard drive. I use Exterro to identify fraud in mobile scenarios only, and in enterprise, I identify fraud when people use their laptops for fraud in the company. My primary use of Exterro is to identify credit card fraud.
My main use case for Exterro is to parse data whenever there is an incident in a company, so I often use Exterro to process the data and parse the artifact to find the relevant data according to the incident that has occurred. A specific example of how I have used Exterro in a real incident involved an insider threat where an employee copied important data to a pen drive. With the help of Exterro, I parsed the image of that particular machine, and by correlating the USB artifact being used at that time and the activity of the logins that accessed that system, I correlated the USB timelines and other artifacts, such as MPAS and SIMCAS, as well as the use of the USB drive at that time, and accordingly set up the correlation of the timeline, proving that the employee copied the important file from the computer itself.
As a forensic science student, I can realistically use Exterro for all of my academic work. It is very easy to understand and manage digital evidence. I use it for storage, tagging, and organized investigations, primarily to study digital evidence management and workflow using Exterro. I try to incorporate what I have learned in my regular classes and apply it using Exterro, which helps me manage and understand the concepts better. I use Exterro for e-discovery, forensic and legal forensics, mobile evidence handling, and cyber crime investigation workflows. Comparing Exterro with Autopsy and FTK Imager, the UI, workflow, and reporting usability are much easier, which is why I use it.
I have been working in my current job for the last eight to ten months, and I have been in the cybersecurity field for the last three years. I have been using Exterro for the last one year. I typically use Exterro to teach students about FTK Imager, which is one of its products, and I teach students about these kinds of tools that are essential for digital forensics. We provide students with FTK Imager as a tool to image certain products when we want them to learn about imaging, and at that particular moment, we use it mainly to image hard disks and similar devices. I also use Exterro to provide an assignment that helps students learn about the different types of images and what kind of images can be worked with.
My main use case for Exterro is conducting forensic analysis with email. After gathering the emails of a company that had a data leak, I used Exterro to identify the central point of this leak and the concatenation of the data on a platform.In addition to forensic analysis with email, Exterro helps me with various types of cases, both more complex cases and post-mortem forensic cases. In all the cases I work on, I use it in my day-to-day work, whether for card data leaks or for validating forensic analyses involving image data.
I have used Exterro at a couple of instances. I've used Exterro throughout my internships as a digital forensic consultant, as well as using Exterro, specifically the FTK Imager and FTK Toolkit, to teach my students in the digital forensics class I teach. I mostly use Exterro for teaching. I usually give my students labs with digital forensics labs where we start off with trying to image the disk at hand, and that's where I use FTK Imager. I usually teach them about hashes, how to image, how to get registry, or even how to analyze memory by taking an image of the memory. Then we go on to analyzing the disk image to find deleted files, recovering artifacts like browser history, emails, and registry keys. The whole process is divided into several labs that I give to my students. Exterro has been the very first tool I usually introduce to my students. Most of the time, my students come back and say that it's very intuitive. Since it's been the very first tool that they get introduced to in the class, it usually leaves a very lasting impact on them. Using Exterro in class has been really helpful in getting students to understand the fundamentals. I use Exterro as a live teaching tool rather than having a simulated environment. Students actually go through and use Exterro with real forensic disk images and practice the same workflow as a practicing examiner would. I know this because I actually used Exterro for my internship. As a digital forensic consultant, we used to analyze all sorts of cases using Exterro, the FTK Toolkit, and the FTK Imager. I try to use the same workflow and the same methodology to teach students who are going to become digital forensic analysts using Exterro. This has been one of the most heavily used cases for Exterro.
We use Exterro as a glorified notification system. It was used by the Office of General Counsel and Debt Collections Group to notify employees that they needed to preserve emails or records, or whatever information they had that pertains to cases where we're suing members, for example. Legal hold matters. It wasn't that we were necessarily using the tool for preservation of any kind. It was just that the old process was basically done through email — there was no structure behind it. That was kind of the main purpose for bringing Exterro in. We are using a SaaS version of Exterro. As far as increasing the usage, that might be TBD. We might expand and maybe other groups might use the tool. But for now, it's just mainly that first group, the Office of General Counsel, and the second group, Debt Collections.