MD5
Virtual Forensic Computing by MD5
Using recognised it-forensic techniques, VFC examines the target drive to gather relevant system information so that it can very quickly build the VMware framework to create a forensically secure copy of the target system (exhibit) as a virtual machine (VM). This process is automated by the VFC software to avoid BSOD and driver errors and save the user hours of manual diagnosis and repair.
VFC enables the virtualisation of Windows, Linux, Solaris and other operating system platforms.
The VFC VM allows the user to move around the suspect's desktop as if they had literally switched on their computer. This can be done by working with forensic images using the integrated mounting tool VFC Mount™ or directly from a read-only hard drive. Due to its simplicity, VFC enables it forensic and non-it forensic professionals to examine computers in a forensic manner, not in hours but in minutes!
VFC can also be used to help an investigator navigate incriminating and exculpatory data. It allows an investigator to visualise a suspect's desktop in a format that can be understood by anyone. This can either be done live in court, using a portable standalone clone of the virtual machine, or captured as still images for reports. This can be of great benefit in cases where a non-technical person such as a judge, lay assessor or lawyer can understand and recognise the data.
Another very important feature that investigators should consider is the "Restore Point Forensics / Patch VM". This allows an investigator to "reset" a PC to a previous state in order to detect links that were stored on the PC in an earlier version of the machine, such as links to websites of dubious or criminal activity that have since been removed.