Remote Analysis Capability for X-Ways Forensics: F-Response
If you need to acquire or examine storage devices or main memory of remote computers, over a network, or cloud storage space, you can use F-Response in conjunction with X-Ways Forensics. F-Response by Agile Risk Management LLC makes various remote data sources completely accessible locally on the examiner’s machine. The F-Response connection is completely read-only, functioning much like a software write blocker. F-Response also allows to access target computers that are running Linux and Mac OS X.
F-Response needs an additional dongle. A license allows you to use F-Response from the time when you receive the dongle for 1 year. After that the license expires, but can be renewed for a reduced price until 4 weeks after the expiration (contact us). F-Response can be purchased from X-Ways, but we offer it only to customers in the EU and in the US. F-Response comes at a fraction of the cost of what you would have to pay for a competing software.
There are different editions of F-Response: Tactical, Consultant (analysis of multiple computers at a time with a single dongle), and Enterprise (optionally non-GUI, service-based, designed for corporate wide covert deployment, scriptable installation, single dongle). Consultant + Covert is the traditionally non-covert (GUI) Consultant version of F-Response + a 2nd “Covert” console designed to allow direct deployment to a single covert target, a great and cost-effective solution. All licenses for F-Response are non-perpetual license, i.e. allow you to use the software for a limited time only.
Product overview • License agreement
Videos: X-Ways Forensics and F-Response Consultant • X-Ways Forensics and F-Response Enterprise • Remote access to RAM
Manuals: F-Response Manual v8 • F-Response TACTICAL v8 Quick Reference Guide • Programming with the F-Response API (with Consultant Edition and higher)
Specific practical scenarios:
- Collecting Amazon EC2 Volume Snapshots
- Collecting Azure Compute Volume Snapshots
- Collecting Google Compute Volume Snapshots
- Collecting a SMB Share
- Collecting a SFTP Share
- Connecting to Azure
- Connecting to Amazon S3
- Connecting to Box.com
- Connecting to Dropbox
- Connecting to GMail
- Connecting to Google Drive
- Connecting to Google Workspace
- Connecting to Office365
- Connecting to OneDrive
- Covert Deployment to a Windows Subject
- Covert Deployment to Non-Windows Subject
- Non-Covert Deployment to a Windows Subject
- Non-Covert Deployment to a Non-Windows Subject
- Using F-Response and Dislocker to unlock remote BitLocker Volumes
- Guide to Getting Started with Tactical v8
- Connecting to Tactical subject using Accelerator on a Linux Examiner
- Using F-Response without a Local Dongle (Accelerator)
