F-Response Now and the fine art of responsiveness
F-Response Now, our first cloud service, provides live access to remote disks, volumes, and memory over the Internet via data centers all over the world. As of our last count we have Now servers in Tokyo, Amsterdam, Frankfurt, London, Paris, Chicago, Dallas, Los Angeles, Miami, New Jersey, New York, San Francisco, Seattle, Silicon Valley, Toronto, Singapore, and Sydney.
F-Response Now was released in 2014, and much like F-Response Universal, it gives an analyst the ability to connect to remote machines virtually anywhere in the world. F-Response Now is available in 1 week and 1 month increments making it an ideal solution for several types of short duration client engagements. Best of all F-Response Now offers a 72 hour money back guarantee, if you cannot get connected, even with our help, you won't pay for your instance(s). It's that simple.
Don't take our word for it though, as Jeff Wichman, Security Consultant pointed out:
"That (F-Response Now) was super easy to get setup and running. Both Encase and FTK agents/servlets kept crashing on a Linux host I was working with after 10-15 minutes. I had the Now instance up and running within 10 -15 minutes and was acquiring 135GB from Chicago to my home office with no issues!"
Acquiring large amounts of data via F-Response Now, or via the Internet alone may not always be what you are hoping to accomplish, however the options are virtually limitless, you could:
Use F-Response Now to get you access to a remote home user's machine and perform triage/incident response services on a potential malware attack.
Use F-Response Now to get you access to a custodian's workstation and review/collect specific user profile documents.
Use F-Response Now to access cloud servers in remote data centers that would not be accessible through other means.
These are just a handful of the use cases we've heard from customers, perhaps you have something else in mind?
Should you decide to get one or more F-Response Now instances for you next project please keep the following rules of thumb in mind:
Choose a Data Center closest to your or your Subjects, it makes little difference which.
Remember you are imaging/accessing over the Internet, not all links are equal and as such you may have to be judicious about what you collect/review.
When in doubt, whitelist. F-Response Now uses web technologies, as such some proxies and firewalls may interfere. We recommend whitelisting the F-Response Now instance if possible.
It would appear more than a handful of people have figured out how to leverage F-Response Now instances. This Summer has been a uptick in Now instances throughout the US. It would appear that avoiding travel expenses, rapidly responding to customers, and getting access to remote data "Now" is giving us better ways to spend our summer days.
And there you have it--access in less than 30 minutes all from the comfort of your laptop poolside.
Enjoy the last of the Summer!
M. Shannon, Principal