MD5 Virtual Forensic Computing 4.17.8.25

MD5 Virtual Forensic Computing

MD5 Virtual Forensic Computing 4.17.8.25 | 86.1 Mb

VFC, which was first launched to the forensic community in 2007, is the original virtualisation solution for the forensic investigator. Version 4 (VFC4) includes some great new features, as requested by users. These enhanced features come alongside a faster, more powerful version of VFC.

Virtual Forensic Computing software is often considered an essential tool for Forensic Investigators, as it allows for seamless recreation of a digital crime scene using the original evidence.

VFC works alongside VMware’s Workstation Player or Workstation Pro and Virtual Disk Development Kit (VDDK) to replicate the suspect’s desktop in a virtual environment.

VMware, in our experience at least, is the most reliable virtualisation tool out there which makes for a smoother user experience. VFC makes VMware do things it wasn’t built to do, fixing errors automatically to save the user hours of complex problem-solving. VMware’s inherent stability helps with this.

For Law Enforcement, no further purchase is necessary since VMware’s Workstation Player is free for non-commercial use. FTK Imager from AccessData is freely available to download and can be used as a no-nonsense mounting tool, however investigators are not tied to particular mounting programs.

VFC works with write-blocked physical drives, Unix-style DD images or mounted forensic images. The software interrogates the target drive to gather relevant system information so that it can very quickly build the VMware framework to create a forensic replica of the target system (the exhibit) as a Virtual Machine (VM). VFC achieves this by following accepted forensic practices while simultaneously and automatically fixing a multitude of known problems to avoid BSOD and driver errors and save the user hours of manual diagnosis and repair.

Please login to view full content

Leave a Reply