F-Response Universal

What is F-Response Universal?

F-Response Universal is a server-based version of our popular computer forensic and e-discovery connection and collection suite. F-Response Universal leverages patented technology to provide access to remote systems virtually anywhere on the network. It creates live, read-only devices on your local examiner machine suitable for forensic analysis, collection, and/or review. In addition, F-Response Universal offers a host of data collection tools for a wide array of different 3rd party data sources including cloud storage, cloud servers, and remote network shares.

Still not sure? You'll find a video of F-Response Universal in action below.

See F-Response Universal in Action

How does F-Response Universal work?

F-Response Universal uses a patented remote connectivity technology that creates an authenticated, read-only connection between the examiner's computer and the computer(s) under inspection over any network. F-Response Universal readily traverses most firewalls (with simple exceptions), NAT/PAT routers, and other complex networking technologies making it remarkably fast and easy to connect to remote systems almost anywhere in the world.

What are the advantages of F-Response Universal over F-Response Enterprise?

F-Response Universal provides access to remote Windows, Linux, and Apple OSX devices via the network, much like F-Response Enterprise. However, F-Response Universal does not require dongle(s), integrates more deeply in your environment, supports Active Directory authentication, and provides the full deployment console to all authenticated examiners. For additional differences between F-Response Universal and the entire F-Response suite of products see the Product Matrix.

Who would use F-Response Universal?

For E-Discovery Professionals

F-Response Universal was designed to give litigation teams extended geographic and technical reach to access live remote machines data in a completely write protected manner, as well as collect data from cloud storage accounts, cloud servers, and remote file shares (Network Attached Storage.)

For Forensic Investigators

F-Response Universal includes access to remote physical disks, volumes, partitions, disk devices, allowing a forensic examiner to leverage existing tools, techniques, and methodologies to perform investigations with pinpoint accuracy and precision.

For Incident Handlers/Responders

F-Response Universal presents remote Windows computer physical memory via the MemoryShare(TM) as a live image file, giving the handler the ability to simply collect the image file or analyze it using a popular forensics tool such as Volatility. The image file is not a snapshot of the remote physical memory, rather it represents the live physical memory of the remote machine.

F-Response Universal Benefits

Full Deployment Capability

F-Response Universal offers the ability to deploy to remote systems via LAN/WAN and MSI. Deployment capability does not require a dongle. All authenticated Universal examiners have the ability to use the full deployment options.

Full Live Read-Only Access, No File Level Locking

F-Response Universal provides live, read-only access to the remote target computer's files. Since all access is at the physical level there is no file level locking, F-Response Universal gives you access to any and all content on the remote target, including protected system content (Registry files, Email PSTs, Database Files, etc).

MemoryShares(TM)

F-Response Universal provides access to remote physical memory via MemoryShares(TM). MemoryShares(TM) provide live physical memory access to remote Windows subject physical memory as a live file, suitable for imaging and analysis with virtually any incident response product.

Windows and Linux Examiner Support

F-Response includes optional installation packages which include scriptable command line components for Linux.

Optional included Imaging capability

F-Response includes optional high speed scriptable imaging (Physical images in Expert Witness "E01" format only).

F-Response Executable and Software

The F-Response functions as a single executable ("exe") on the remote target computer that requires no drivers or installation components, as well as no reboot when deployed and started. F-Response is 100% functional with the latest versions of Microsoft Windows.

Security

All subject data in transit when using F-Response Universal is encrypted using AES 256 bit symmetric encryption.

Multi-Platform Support

Multi-platform support is included in F-Response Universal, further extending the team's reach into Linux and Apple platforms. F-Response Universal Supports Apple OSX 10.3+ (Note: SIP must be disabled in 10.13+) and Linux Distributions 2002+.

Remote File Share Collection (SMB, NAS, etc.)

F-Response Universal includes support for collecting file and folder content from remote SMB and SFTP shares. This includes both NAS devices, and remote Windows, Linux, and Apple servers. For more details on F-Response's specific SMB and SFTP collection options, please see the appropriate Mission Guide on our Mission Guides and Documentation page.

Cloud Server Collection

F-Response Universal includes support for snapshotting and collecting Amazon EC2 and Azure Compute server volume images. For more details on F-Response's specific EC2 and Azure Compute collection options, please see the appropriate Mission Guide on our Mission Guides and Documentation page.

Cloud Files Collection

F-Response Universal includes support for collecting cloud data from the following providers: Azure Blog Storage, Amazon Simple Storage Services (S3), Box.com for Business, Box.com for Consumers, Dropbox for Business, Dropbox for Consumers, Google Drive for Consumers, Google Mail for Consumers, Google Workspaces (Formerly GSuite), Microsoft OneDrive for Consumers, and Office365 OneDrive. For more details on F-Response's specific Cloud Files collection options, please see the appropriate Mission Guide on our Mission Guides and Documentation page.

Licensing and Usage

F-Response Universal is sold in 1 and 3 year license terms. F-Response Universal has no licensed limit to the number of concurrent examiners or connections (actual performance may vary based on bandwidth, region networks, client systems, etc).

Buy F-Response Universal

F-Response Univeral is available in 1 and 3 year license terms and can be purchased directly from F-Response.com. Buy F-Response Universal.

IMPORTANT NOTE: Always remember, all licenses of F-Response automatically include maintenance, support, limited online training, enhancements, implementation assistance, and new releases throughout the term of your license.