VFC gives a new dynamic to the way an investigator works on an investigation VFC Lab puts the investigator “in the room” with the original user, providing invaluable access to software and data that cannot be easily found with a typical examination. The investigator can find evidence in its easiest format, just like the original user. Each device that is examined is different, and therefore, having quick and easy access to the original is invaluable.
VFC has many features which make it one of the most powerful tools that a digital\cyber\incident response forensic investigator can use.
Once a drive or image is mounted, VFC will take minutes to create a VM, including bypassing the user account passwords, and injecting your preferred analysis software.
VFC quickly triages a device within minutes of obtaining the device.
VFC is capable of virtualising from many different image types – including Single Volume Images and to virtualise from write blocked drives.
VFC is forensically sound The generated VM can be viewed as a sandbox environment that not only allows you to analyse the device, it allows you to test and change things repeatably.
VFC LAB features
Password Bypass Tool does as its name suggests and bypasses the windows user account passwords.
GPR Tool – resets the local user account password, as well as being able to convert windows live accounts to local accounts. With the aid of the GPR tool, you are able to view any saved autofill information in the browser history.
Access computers configured with S-Mode
We realise that not one organisation or entity is the same when it comes to who triages devices and how devices are triaged. That’s why it is important to have a simple tool that allows someone to look at evidence in a simple format is crucial.
VFC General Features
Easy to use – built on over 15 years of R&D in creating VM’s you just need minimum IT Skills to operate. Take Analysis to another level -Experience the original user desktop and take screenshots or video key evidence items for use in reports interviews and court.
Interact with original connected devices such as: