F-Response Enterprise

What is F-Response Enterprise?

F-Response Enterprise is the covert, dongle-based version of our popular computer forensic and e-discovery connection and collection suite. F-Response Enterprise leverages patented technology to provide access to remote systems over LAN and WAN networks. It creates covert, live, read-only devices on your local examiner machine suitable for forensic analysis, collection, and/or review. In addition, F-Response Enterprise offers a host of data collection tools for a wide array of different 3rd party data sources including cloud storage, cloud servers, and remote network shares.

Still not sure? You'll find a video of F-Response Enterprise in action below.

See F-Response Enterprise in Action

How does F-Response Enterprise work?

F-Response Enterprise uses a patented remote connectivity technology that creates an authenticated, read-only connection between the examiner's computer and the computer(s) under inspection over any network. F-Response presents the drives, volumes, or memory (Windows only) of that machine as local, read-only, physical devices on your examiner machine.

F-Response Enterprise is the unlimited covert subject version of F-Response. Simply put, this means with F-Response Enterprise edition there is no limit to the number of remote covert subjects at any given time. In addition, F-Response Enterprise deployment and connectivity was designed to be covert and efficient allowing the investigator to access multiple machines quickly without concern for alerting the end user.

Who would use F-Response Enterprise?

For E-Discovery Professionals

F-Response Enterprise was designed to give litigation teams extended geographic and technical reach to access live remote machines data in a completely write protected manner, as well as collect data from cloud storage accounts, cloud servers, and remote file shares (Network Attached Storage.)

For Forensic Investigators

F-Response Enterprise includes access to remote physical disks, volumes, partitions, disk devices, allowing a forensic examiner to leverage existing tools, techniques, and methodologies to perform investigations with pinpoint accuracy and precision.

For Incident Handlers/Responders

F-Response Enterprise presents remote Windows computer physical memory as a physical device. The attached device is not a snapshot of the remote physical memory, rather it represents the live physical memory of the remote machine.

F-Response Enterprise Benefits

Full Deployment Capability

F-Response Enterprise offers the ability to deploy to remote systems via LAN/WAN and MSI. Deployment capability does require a dongle.

Full Live Read-Only Access, No File Level Locking

F-Response Enterprise provides direct, live, read-only access to the remote target computer's disks, volumes, and in certain cases physical memory. Since all access is at the physical level there is no file level locking, F-Response gives you access to any and all content on the remote target, including protected system content (Registry files, Email PSTs, Database Files, etc).

Windows and Linux Examiner Support

F-Response includes optional installation packages which include scriptable command line components for Linux.

Optional included Imaging capability

F-Response includes optional high speed scriptable imaging (Physical images in Expert Witness "E01" format only).

F-Response Executable and Software

The F-Response functions as a single executable ("exe") on the remote target computer that requires no drivers or installation components, as well as no reboot when deployed and started. F-Response is 100% functional with the latest versions of Microsoft Windows.

Security

All subject data in transit when using F-Response Enterprise is encrypted using AES 256 bit symmetric encryption.

Multi-Platform Support

Multi-platform support is included in F-Response Enterprise, further extending the team's reach into Linux, Solaris, AIX, and Apple platforms. F-Response Enterprise supports Apple OSX 10.3+ (Note: SIP must be disabled in 10.13+) and Linux Distributions 2002+.

Remote File Share Collection (SMB, NAS, etc.)

F-Response Enterprise includes support for collecting file and folder content from remote SMB and SFTP shares. This includes both NAS devices, and remote Windows, Linux, and Apple servers. For more details on F-Response's specific SMB and SFTP collection options, please see the appropriate Mission Guide on our Mission Guides and Documentation page.

Cloud Server Collection

F-Response Enterprise includes support for snapshotting and collecting Amazon EC2 and Azure Compute server volume images. For more details on F-Response's specific EC2 and Azure Compute collection options, please see the appropriate Mission Guide on our Mission Guides and Documentation page.

Cloud Files Collection

F-Response Enterprise includes support for collecting cloud data from the following providers: Azure Blog Storage, Amazon Simple Storage Services (S3), Box.com for Business, Box.com for Consumers, Dropbox for Business, Dropbox for Consumers, Google Drive for Consumers, Google Mail for Consumers, Google Workspaces (Formerly GSuite), Microsoft OneDrive for Consumers, and Office365 OneDrive. For more details on F-Response's specific Cloud Files collection options, please see the appropriate Mission Guide on our Mission Guides and Documentation page.

Licensing and Usage

F-Response Enterprise is sold in 1 and 3 year license terms. F-Response Enterprise has no licensed limit to the number of concurrent examiners or connections (actual performance may vary based on bandwidth, region networks, client systems, etc).

F-Response Scripting and Programming

F-Response Enterprise Edition uses a simple JSON POST style RPC mechanism. This means that local scripting of F-Response is accessible from just about any scripting language that can send and receive HTTP JSON POSTs with JSON data. Learn more about the F-Response API here.

Buy F-Response Enterprise

F-Response Enterprise is available in 1 and 3 year license terms and can be purchased directly from F-Response.com. Buy F-Response Enterprise.

IMPORTANT NOTE: Always remember, all renewal prices are available here on our website, and all licenses of F-Response automatically include maintenance, support, online training, enhancements, implementation assistance, and new releases throughout the term of your license.