GetData Software, authors of the computer forensic software Mount Image Pro, now offer VFC (Virtual Forensic Computing), British developed software that allows investigators to boot a forensic image of a suspect’s computer. With GetData’s Mount Image Pro v2 and MD5 Ltd’s VFC an investigator can now log into a suspect’s computer, just as the suspect did, whilst operating within a forensically sound ‘virtual’ environment.This “scene of the crime†capability has been missing from forensic software, with most traditional computer forensic tools accessing data at a file system level and lower.
“The way a user sets up their computer desktop and electronic filing system can give you a great insight into the type of person they are and their activitiesâ€, explained GetData Director Graham Henley, a former forensic investigator with the Australian Federal Police computer crimes unit.
“In many cases the evidence is right there in front of you. VFC technology has the potential to greatly speed up complex investigationsâ€.
Mount Image Pro v2 and VFC also have practical applications for lawyers, prosecutors, police, forensic accountants, courts and other users who deal with electronic evidence.
Clients include: FBI, USA Military Investigations, corporate investigators, major law firms, State and Federal law enforcement agencies.
Mount Image Pro v2 mounts the image files as a drive letter under the Windows file system. VFC then creates the bootable virtual machine which can immediately be launched in VMWare. VFC can successfully create bootable virtual machines from:
• Encase (*.e01) or Smart (*.s01) forensic image files (using Mount Image Pro v2)
• Write blocked original storage devices.
• Unix style ‘dd’ bit-for-bit disk images.
• Vogon format ‘img’ image files.
Mount Image Pro v2 and VFC are available for download, trial use and purchase from GetData’s website at http://www.mountimage.com.
EnCase is the trademark of Guidance Software, VFC is the trademark of MD5 Ltd., Mount Image Pro is the trademark of GetData Pty Ltd..
