F-Response Consultant

What is F-Response Consultant?

F-Response Consultant is the non-covert subject version of F-Response. Simply put, this means with F-Response Consultant offers unlimited non-covert subject connections. F-Response Consultant leverages patented technology to provide access to remote systems over LAN and WAN networks. It creates live, read-only devices on your local examiner machine suitable for forensic analysis, collection, and/or review. In addition, F-Response Consultant offers a host of data collection tools for a wide array of different 3rd party data sources including cloud storage, cloud servers, and remote network shares.

Still not sure? You'll find a video of F-Response Consultant in action below.

See F-Response Consultant in Action

How does F-Response Consultant work?

F-Response Consultant uses a patented remote connectivity technology that creates an authenticated, read-only connection between the examiner's computer and the computer(s) under inspection over any network. F-Response presents the drives, volumes, or memory (Windows only) of that machine as local, read-only, physical devices on your examiner machine.

F-Response Consultant is the unlimited non-covert subject version of F-Response. Simply put, this means with F-Response Consultant there is no limit to the number of remote graphical subjects at any given time. What F-Response Consultant edition lacks in deployment it makes up for in ease of use and low price point.

Who would use F-Response Consultant?

For E-Discovery Professionals

F-Response Consultant was designed to give litigation teams extended geographic and technical reach to access live remote machines data in a completely write protected manner, as well as collect data from cloud storage accounts, cloud servers, and remote file shares (Network Attached Storage.)

For Forensic Investigators

F-Response Consultant includes access to remote physical disks, volumes, partitions, disk devices, allowing a forensic examiner to leverage existing tools, techniques, and methodologies to perform investigations with pinpoint accuracy and precision.

For Incident Handlers/Responders

F-Response Consultant presents remote Windows computer physical memory as a physical device. The attached device is not a snapshot of the remote physical memory, rather it represents the live physical memory of the remote machine.

F-Response Consultant Benefits

Full Live Read-Only Access, No File Level Locking

F-Response Consultant provides direct, live, read-only access to the remote target computer's disks, volumes, and in certain cases physical memory. Since all access is at the physical level there is no file level locking, F-Response gives you access to any and all content on the remote target, including protected system content (Registry files, Email PSTs, Database Files, etc).

Windows and Linux Examiner Support

F-Response includes optional installation packages which include scriptable command line components for Linux.

Optional included Imaging capability

F-Response includes optional high speed scriptable imaging (Physical images in Expert Witness "E01" format only).

F-Response Executable and Software

The F-Response functions as a single executable ("exe") on the remote target computer that requires no drivers or installation components, as well as no reboot when deployed and started. F-Response is 100% functional with the latest versions of Microsoft Windows.

Security

All subject data in transit when using F-Response Consultant is encrypted using AES 256 bit symmetric encryption.

Multi-Platform Support

Multi-platform support is included in F-Response Consultant, further extending the team's reach into Linux, Solaris, AIX, and Apple platforms. F-Response Consultant supports Apple OSX 10.3+ (Note: SIP must be disabled in 10.13+) and Linux Distributions 2002+.

Remote File Share Collection (SMB, NAS, etc.)

F-Response Consultant includes support for collecting file and folder content from remote SMB and SFTP shares. This includes both NAS devices, and remote Windows, Linux, and Apple servers. For more details on F-Response's specific SMB and SFTP collection options, please see the appropriate Mission Guide on our Mission Guides and Documentation page.

Cloud Server Collection

F-Response Consultant includes support for snapshotting and collecting Amazon EC2 and Azure Compute server volume images. For more details on F-Response's specific EC2 and Azure Compute collection options, please see the appropriate Mission Guide on our Mission Guides and Documentation page.

Cloud Files Collection

F-Response Consultant includes support for collecting cloud data from the following providers: Azure Blog Storage, Amazon Simple Storage Services (S3), Box.com for Business, Box.com for Consumers, Dropbox for Business, Dropbox for Consumers, Google Drive for Consumers, Google Mail for Consumers, Google Workspaces (Formerly GSuite), Microsoft OneDrive for Consumers, and Office365 OneDrive. For more details on F-Response's specific Cloud Files collection options, please see the appropriate Mission Guide on our Mission Guides and Documentation page.

Licensing and Usage

F-Response Consultant is sold in 1 and 3 year license terms. F-Response Consultant offers no covert connections.

F-Response Scripting and Programming

F-Response Consultant Edition uses a simple JSON POST style RPC mechanism. This means that local scripting of F-Response is accessible from just about any scripting language that can send and receive HTTP JSON POSTs with JSON data. Learn more about the F-Response API here.

Buy F-Response Consultant

F-Response Consultant is available in 1 and 3 year license terms and can be purchased directly from F-Response.com. Buy F-Response Consultant.

IMPORTANT NOTE: Always remember, all renewal prices are available here on our website, and all licenses of F-Response automatically include maintenance, support, online training, enhancements, implementation assistance, and new releases throughout the term of your license.