Ftk — Imager Could Not Start Driver

The you're using (e.g., Lite 3.1.1 or 4.7)

Verify driver signature enforcement (temp test)

Modern versions of Windows 10 and Windows 11 feature enhanced virtualization-based security. A feature called prevents unsigned or older drivers from loading into the Windows kernel. Because some versions of FTK Imager utilize legacy drivers, Windows proactively blocks them.

FTK Imager relies on a kernel-level device driver (commonly ad_driver.sys ) to perform its core functions, such as accessing physical drives, mounting forensic images, and performing memory dumps. The error occurs when Windows is unable to communicate with or load this essential driver. This is often due to modern security features in Windows, permission issues, or conflicts with other software.

If the driver absolutely will not start and you cannot reboot (live forensic acquisition):

: A Windows security feature that uses hardware virtualization to protect system processes. It often prevents older or unsigned drivers—like those used by specific versions of FTK Imager—from loading to prevent malware injection.