VFC, the original virtualization solution for forensic investigators, was first introduced to the forensic community in 2007. Version 4 (VFC4) brought about significant enhancements based on user feedback, presenting an improved and more powerful VFC.

Considered an essential tool for forensic investigators, Virtual Forensic Computing (VFC) seamlessly recreates a digital crime scene using the original evidence. Working in tandem with VMware’s Workstation Player or Workstation Pro and Virtual Disk Development Kit (VDDK), VFC replicates the suspect’s desktop in a virtual environment.

VMware has proven to be the most reliable virtualization tool, ensuring a smoother user experience. VFC pushes VMware beyond its intended capabilities, automatically fixing errors to save users hours of complex problem-solving. The inherent stability of VMware further contributes to this efficiency.

For Law Enforcement, there's no need for additional purchases, as VMware’s Workstation Player is free for non-commercial use. FTK Imager from AccessData, also freely available, serves as a no-nonsense mounting tool, providing flexibility without tying investigators to specific programs.

VFC seamlessly works with write-blocked physical drives, Unix-style DD images, or mounted forensic images. By following accepted forensic practices, it quickly builds the VMware framework and creates a forensic replica of the target system as a Virtual Machine (VM). VFC automates the process while addressing known issues, preventing BSOD and driver errors.

The resulting VFC VM is launched in VMware, allowing users to navigate the suspect’s desktop as if the machine were physically turned on. Default security settings disable network connections to ensure a secure environment.

VFC now introduces features such as adding hardware to an existing VFC VM, enabling the reconstruction of systems with multiple drives. Additionally, it offers the capability to export a standalone clone of a VM for further investigation without tying up the forensic workstation.

Building on the strengths of its predecessor, VFC Version 7 further enhances the forensic investigator’s toolkit. Here's a breakdown of key features and benefits, comparing the two versions: