MD5 Virtual Forensic Computing 22.214.171.124 | 86.1 Mb
VFC, which was first launched to the forensic community in 2007, is the original virtualisation solution for the forensic investigator. Version 4 (VFC4) includes some great new features, as requested by users. These enhanced features come alongside a faster, more powerful version of VFC.
Virtual Forensic Computing software is often considered an essential tool for Forensic Investigators, as it allows for seamless recreation of a digital crime scene using the original evidence.
VFC works alongside VMware’s Workstation Player or Workstation Pro and Virtual Disk Development Kit (VDDK) to replicate the suspect’s desktop in a virtual environment.
VMware, in our experience at least, is the most reliable virtualisation tool out there which makes for a smoother user experience. VFC makes VMware do things it wasn’t built to do, fixing errors automatically to save the user hours of complex problem-solving. VMware’s inherent stability helps with this.
For Law Enforcement, no further purchase is necessary since VMware’s Workstation Player is free for non-commercial use. FTK Imager from AccessData is freely available to download and can be used as a no-nonsense mounting tool, however investigators are not tied to particular mounting programs.
VFC works with write-blocked physical drives, Unix-style DD images or mounted forensic images. The software interrogates the target drive to gather relevant system information so that it can very quickly build the VMware framework to create a forensic replica of the target system (the exhibit) as a Virtual Machine (VM). VFC achieves this by following accepted forensic practices while simultaneously and automatically fixing a multitude of known problems to avoid BSOD and driver errors and save the user hours of manual diagnosis and repair.Please login to view full content