Absolutely. Microsoft's security updates frequently update the list of trusted drivers. If a driver used by FTK Imager has been flagged or its certificate has been revoked by an update, Windows will block it.
If you are running a portable version or an older deployment (such as FTK Imager Lite 3.1.x) and the certificate is blocked, running it strictly through an administrative shell forces the execution: ftk imager could not start driver new
Forensic tools behave like malware in terms of low-level disk access. Sophisticated antivirus (especially CrowdStrike, SentinelOne, or Windows Defender ASR rules) will actively block the installation of forensic drivers. Absolutely
: Avoid installing software directly onto host operating systems. Utilize write-blocked bootable systems like a SUMURI PALADIN Live USB to safely isolate data and bypass host driver security restrictions. If you are running a portable version or
Troubleshooting “FTK Imager Could Not Start Driver” Errors