MD5 is regarded as one of the leading digital forensic solutions companies in the UK and creators of the world Renowned Software - Virtual Forensic Computing (VFC). VFC is the most significant breakthrough in Computer Forensics within the last ten years developed by MD5 LTD for use in every computer forensic investigation worldwide.
Virtual forensic Computing 4 (VFC4) is a more powerful and faster version of VFC. This new, next-generation product contains a number of enhanced, improved and brand new features which have been requested for development by our valued customers.
VFC4 will benefit you in the following ways:
· Faster processing.
· More than twice as many Windows password bypass routines compared to VFC3
(starting with 276).
· Password Bypass (PWB) database updates will no longer require reinstallation of VFC.
· Point-and-click option to add in additional hardware to load external or multiple drives into an existing VM (to rebuild the suspect machine as last viewed by them) – Still in Development.
· Point-and-click generation of a standalone Virtual Machine for sharing with non-technical departments – Still in Development.
· Network License capability for up to 100 seats.
… In addition to the following existing (VFC3) features and benefits:
· 134 Windows Password Bypass Routines (including Windows 10).
· Support for Windows 3.1 - Windows 10.
· Additional support for Apple Mac OSX, Linux and Sun Solaris OS’s.
· Partition image support.
· Support for GPT formatted disks (including password bypass)
· Detection of up-to-date versions of VMware and VDDK.
· Last date of use (start-up, shutdown) and user accounts read directly from the registry.
· Full Computer Forensics applications (e.g. EnCase/X-Ways) or additional disk emulation modules are not required.
· No need to restore Computer Forensics image files to another PC to try and boot them.
· Work from a mounted E01 or DD image.
· Work directly from a write-blocked physical hard-drive.
· Boot a forensic image of a suspect’s computer.
· Forensically launch a suspect’s machine in its native environment.
· Experience the ‘desktop’ as seen by the original user.
· ‘Rewind’ a machine using Restore Point Forensics.
· Check for auto-run cleaning software and up-to-date anti-virus.
· Use screen-grabbed images to help explain technical evidence.
· Use inherent software to view active downloads or open up and export spreadsheets.
VFC seamlessly and expeditiously re-creates a virtual crime scene from either the original evidence drive itself or the forensic copy of the suspect’s machine. The VFC process normally takes less than a minute including password bypass routine. Crucially for the forensic investigator, the process never alters the original evidence and can be repeated at will.
The VFC application utilises VMware's freely available Player or Workstation, along with the Computer Forensics disk mount tools; Mount Image Pro or FTK Imager, to re-create a subject machine in a matter of seconds.