VFC Portable is designed to use the existing hardware – on scene, in the lab, and just about anywhere required.
The functionality of VFC Portable is the exactly the same as VFC Lab, with the added features that enables VFC to be used in the field.
Write blocking behaviour – VFC Portable allows you to disable automatic disk online, SSD and Windows Dynamic Disks. This feature can be found in the settings/tools tab in VFC. (portable addition only). Drives will be read only.
VFC Portable can be used in Memory capture analysis in both live and deadbox enquiries by creating a .vmem file when generating a VM
Being able to quickly triage a computer device on scene is vital. When conducting on scene triage, you want to be in and out as quickly as possible, while collecting sufficient evidence to warrant bringing the device back to the lab or even decide it does not meet the case parameters. VFC triage allows you quick and safe access to the device, within 30 seconds of selecting the partition, you will be able to view the VFC Triage log that can provide you with the following:
Inject files – This feature allows you to inject third party analysis software into a VM while VFC is generating a VM. This can be anything to aid with the analysis. For example, you could inject tried and trusted analysis tools to analyse a device onsite.
Access computers configured with S-Mode
Password Bypass Tool does as its name suggests and bypasses the windows user account passwords.
GPR Tool resets the local user account password, as well as being able to convert windows live accounts to local accounts. With the aid of the GPR tool, you are able to view any saved autofill information in the browser history.
VFC General Features
Easy to use –built on over 15 years of R&D in creating VM’s youjust need minimum IT Skills to operate. Take Analysis to another level -Experience the original user desktop and take screenshots or video key evidence items for use in reports, interviews and court.
Original folder structure and desktop layout (as seen by the original user)
Recently accessed files and network shares
Browsing history, saved passwords and P2P accounts
View data using original software e.g. Sage, QuickBooks, Photoshop etc
Access data eg. Crypto Currency Wallets or other online systems using original user credentials
Access time-limited or expired software