PRODUCTS

Solve your cases faster with the fitting tools!

banner image

VFC

VFC, the original virtualization solution for forensic investigators, was first introduced to the forensic community in 2007. Version 4 (VFC4) brought about significant enhancements based on user feedback, presenting an improved and more powerful VFC.

Considered an essential tool for forensic investigators, Virtual Forensic Computing (VFC) seamlessly recreates a digital crime scene using the original evidence. Working in tandem with VMware’s Workstation Player or Workstation Pro and Virtual Disk Development Kit (VDDK), VFC replicates the suspect’s desktop in a virtual environment.

VMware has proven to be the most reliable virtualization tool, ensuring a smoother user experience. VFC pushes VMware beyond its intended capabilities, automatically fixing errors to save users hours of complex problem-solving. The inherent stability of VMware further contributes to this efficiency.

For Law Enforcement, there's no need for additional purchases, as VMware’s Workstation Player is free for non-commercial use. FTK Imager from AccessData, also freely available, serves as a no-nonsense mounting tool, providing flexibility without tying investigators to specific programs.

VFC seamlessly works with write-blocked physical drives, Unix-style DD images, or mounted forensic images. By following accepted forensic practices, it quickly builds the VMware framework and creates a forensic replica of the target system as a Virtual Machine (VM). VFC automates the process while addressing known issues, preventing BSOD and driver errors.

The resulting VFC VM is launched in VMware, allowing users to navigate the suspect’s desktop as if the machine were physically turned on. Default security settings disable network connections to ensure a secure environment.

VFC now introduces features such as adding hardware to an existing VFC VM, enabling the reconstruction of systems with multiple drives. Additionally, it offers the capability to export a standalone clone of a VM for further investigation without tying up the forensic workstation.

Building on the strengths of its predecessor, VFC Version 7 further enhances the forensic investigator’s toolkit. Here's a breakdown of key features and benefits, comparing the two versions:

VFC Features & Benefits:

  • Seamless recreation of digital crime scenes using original evidence.
    • Compatibility with VMware’s Workstation Player or Workstation Pro and Virtual Disk Development Kit (VDDK).
    • Replication of the suspect’s desktop in a secure virtual environment.

VMware, known for its reliability in virtualization, provides a smooth user experience when coupled with VFC. Pushing beyond its intended capabilities, VFC Version 7 automatically addresses errors, saving users hours of complex problem-solving. VMware’s inherent stability further contributes to this efficiency.

Forensic Capabilities:

  • Seamless operation with write-blocked physical drives, Unix-style DD images, or mounted forensic images.
  • Quick building of the VMware framework, creating a forensic replica of the target system as a Virtual Machine (VM).
  • Automation of the process while addressing known issues, preventing BSOD and driver errors.

VFC Version 7 Enhancements:

  • Improved capability to add hardware to an existing VFC VM for reconstructing systems with multiple drives.
  • Introduction of the capability to export a standalone clone of a VM for further investigation without tying up the forensic workstation.

The resulting VFC VM is launched in VMware, allowing users to navigate the suspect’s desktop as if the machine were physically turned on. Default security settings disable network connections to ensure a secure environment.

Experience the enhanced capabilities of VFC Version 7, representing the latest advancements in forensic virtualization technology

For further information please contact us or click here.

Contact persons

Our experts are happy to help you.

Johannes Seitz

Hardware & Software Sales
E-MAIL: johannes.seitz@mh-service.de
PHONE: +49 (0) 7275 40444-52

Erika Lojko

Software Sales
E-MAIL:erika.lojko@mh-service.de
PHONE:+49 (0) 7275 40444-29