VFC
Virtual Forensic Computing software is often considered an essential tool for Forensic Investigators, as it allows for seamless recreation of a digital crime scene using the original evidence.
VFC works alongside VMware’s Workstation Player or Workstation Pro and Virtual Disk Development Kit (VDDK) to replicate the suspect’s desktop in a virtual environment.
VFC v7 now supports non-bootable single volume images. These are images that contain a complete file system but lack components removed found in a whole disk image. VFC v7 can now emulate seamlessly the missing components and allow such images to be converted to a bootable virtual machine.
Virtualising a single volume image involves setting up a virtual environment where the contents of the single volume image can be accessed and interacted with as if it were a physical storage volume. A virtual machine provides a controlled and isolated environment to work with the contents of the image, making it easier to analyse and manipulate the data without affecting the original image.
VFC does all this for you which makes it an invaluable tool that can be used for various purposes such as Cyber\Digital Forensic testing, development and analysis.
This is particularly useful for images that were captured as a single volume or where an image has been converted from another volume based format such as a device that is TPM(TCM) encrypted, BitLocker and VeraCrypt encrypted, or any supported image format that can be converted in this way.
Using VFC to Virtualise a TPM, BitLocker or VeraCrypt encrypted single volume image enables controlled access and analysis of the decrypted data without modifying the original image
Product page
MD5 products