In order to examine a suspect's computer, Law Enforcement professionals will usually undertake forensic cloning /imaging of the original storage device, effectively copying all the data stored on the suspect's computer for later analysis, using specialist forensic software. This secured data is rarely viewed within its original environment and the investigator can potentially miss vital 'scene of crime' information.
From forensic image to virtual machine in seconds
Re-create suspect's computer in a virtual environment
A vital addition to any digital investigator's toolbox
View the evidence just as it would have been on the original machine
Validate the findings of other forensic tools
VFC seamlessly and expeditiously re-creates a virtual scene from either the original evidence drive itself or the forensic copy of the suspect's system. The VFC process normally takes less than a minute, with average system start up times of the virtual clone ranging from between 2-5 minutes. Crucially for the forensic investigator, the process never alters the original evidence and can be repeated at will. Industry experts will be well aware how unique VFC is; it provides a straightforward and user friendly interface that can be used by any investigative agency, be it criminal or civil, in order to quickly ascertain the need for further examination of the system. The VFC method enables any legal professional to experience the suspect's system in its own 'virtual' environment, accessing the original data but leaving it wholly intact. How better to display evidence than by 'virtually' using the original machine and data? Descriptions of technical processes and file locations are easily and implicitly understood when visually demonstrated. VFC is a simple, cost effective tool designed to present evidential data in a virtual environment.
VFC version 2 has a number of exciting new features in addition to the key features from version 1. Rapidly access any Windows based user account without the password using the new innovative password bypass feature. See what the user was doing last week by rewinding their machine to 'last week' and utilising restore point forensics. A virtual machine can be created from a forensic image, a write blocked physical disk or a 'DD' raw flat file image.
In development is hardware modification to add network capability and enhanced partition handling. For existing VFC users we have a discounted upgrade package.
