F-Response is an easy to use, vendor neutral, patented software utility that enables an investigator to conduct live Forensics, Data Recovery, and eDiscovery over an IP network using their tool(s) of choice. F-Response is not another analysis tool. F-Response is a utility that allows you to make better use of the tools and training that you already have.
The Consultant + Covert Edition of F-Response is the traditionally non-covert (GUI) version of F-Response + a 2nd "Covert" console designed to allow direct deployment to a single covert target.
F-Response software uses a patented process to provide read-only access to full physical disk(s), physical memory (RAM), 3rd party Cloud, Email and Database storage. Designed to be completely vendor neutral, if your analysis software reads a hard drive or network share, it will work with F-Response.
Using F-Response Consultant + Covert Edition and the F-Response Consultant Connector(FCC) investigators can connect to a virtually limitless number of remote target machines. F-Response Consultant allows you the examiner to obtain completely vendor neutral, write protected access to remote physical disks, logical volumes, and in some cases physical memory from over ten different remote operating system environments.
F-Response Consultant + Covert Edition also includes access to the F-Response Accelerator, a secondary connectivity tool allowing for an unlimited number of remote examiners. In addition, the "+ Covert" edition of F-Response Consultant provides a secondary Covert Console for direct deployment of the covert version of F-Response to a single remote target.
- Full Live Read-Only Access, No File Level Locking
F-Response provides direct, live, read-only access to the remote target computer's disks, volumes, and in certain cases physical memory. Since all access is at the physical level there is no file level locking, F-Response gives you access to any and all content on the remote target, including protected system content (Registry files, Email PSTs, Database Files, etc).
- F-Response Executable and Software
The F-Response Consultant + Covert functions as a single executable ("exe") on the remote target computer that requires no drivers or installation components, as well as no reboot when deployed and started. In addition, the F-Response Consultant Connector and the Covert Console were designed to use minimal resources and are highly portable, requiring only the minimum resources necessary to run Windows XP. F-Response Consultant + Covert is 100% Windows 7 validated and carries the Microsoft Windows 7 Validation logo.
- F-Response Flexdisk™ Support
The F-Response Flexdisk™ (Patent Pending) is a web based disk access and representation tool. The Flexdisk™ uses standard web technologies (HTTPS/REST ) to provide direct access to the remote target machines Logical and Physical targets in both raw and logical format. The Flexdisk™ can be accessed and used from any modern web browser and also exposes a feature rich and extensible application programming interface (API) accessible from any system capable of making and interpreting web queries and JSON .
- F-Response Targets and Platform Support
F-Response works with all RAID disks, physical drives, logical volumes, and physical memory (32 & 64 bit Windows). In addition, F-Response Consultant + Covert includes target executables for over ten (10+) operating system environments, including exotic hardware such as IBM AIX and HPUX. Furthermore based on its unique vendor neutral patented design, F-Response works with all Computer Forensics, eDiscovery and Data Recovery software packages, simply put, if your package reads from a hard drive, it will work with F-Response.
- F-Response Licensing and Usage
F-Response Consultant + Covert includes unlimited installations, connections (Covert feature limited to a single active connection), and examiners for a period of one or three year(s) from the date of purchase. Software will cease to function at the end of the license duration unless renewed. In addition, F-Response Consultant + Covert Edition includes a license for F-Response Consultant Edition, Field Kit Edition, and the F-Response Accelerator, allowing true many-to-many connectivity from any examiner platform.
- F-Response Scripting and Programming
F-Response Consultant + Covert Edition includes access to a fully scriptable COM Object capable of automating many of the F-Response Consultant Connector tasks from any programming environment that supports COM (Scripting capabilities not available for Covert Console).