MD5 VFC 5
MD5's Virtual Forensic Computing software uses VMware's Workstation Player or Workstation Pro and Virtual Disk Developement Kit (VDDK), combined with image mounting tools to replicate the subject's desktop in a virtual environment in no time.

MD5 VFC 5

  • Boot a forensic image of a suspect’s computer
  • Forensically launch suspect's machine in native environment
  • Experience the “desktop” as seen by the original user
  • Take screenshots of key evidence such as folder structure, evidence location, recently accessed files, browsing history & saved passwords, P2P shares and virus definitions among others
  • Interact with fully licenced software to view files and data in its native environment (e.g. Sage or QuickBooks) without the need to invest in a copy of the often-expensive software
  • Interact with connected devices (e.g. iPhones with inherent iTunes accounts or encrypted USB drives)
Product Brief Official Website

When devices meet survey criteria, MD5 creates a separate virtual machine for each device.You can use it to investigate desktops, folders, software, financial databases, and general data on your device without changing the original evidence.By booting the recovered computer device virtually, it is as if the original device has been powered on, enabling analysis/investigation to take place in the same computer environment as the original user sees.

Description
  • Bypass Windows User Account passwords using at least 276 password bypass routines.
  • Includes PassWord Bypass (PWB) Routines for Windows 7, Windows 8 & Windows 10.
  • The latest update* includes PWB routines for 42 variants of Windows 10 OS alone.
  • PWB routines now externalised from the main program for faster, independent updates.
  • PWB process expedited for quicker analysis and implementation.
  • User Account Password hashes are now always extracted to the splash screen.
  • These are also embedded in the VMX annotation.
  • The provision of password hashes enables the use of external hash-cracking tools to identify the original system-password (helps with programs that require EFS access.)
  • Point-and-click option to add in additional hardware to load external or multiple drives into an existing VM (to rebuild the suspect machine as last viewed by them.)
  • Point-and-click generation of a standalone Virtual Machine for sharing with non-technical departments.
  • Restore Point Forensics allows the user to ‘Rewind’ a VFC VM back in time.
  • Larger GUI and bigger splash screen on home tab.
  • Supports GPT formatted disks.
  • Support for Windows 3.1 – Windows 10.
  • for Linux, Sunslaris and others.
  • Heavy investment in R & D resulting in regular updates.
  • Full phone and email support.