MD5
MD5 is an UK company mainly providing services to different customer segments.
Along their way, MD5 developed the software VFC, which allows the investigator to virtually start a computer system based on the hard drive copy that was taken previously. The software quickly became a well-known tool in digital forensics and it will help you to save time and avoid common problems when starting up a virtual computer off an image.
Strengths: System Virtualization, Usability
VFC
VFC allows the investigator to virtually boot a forensic image with the help of VMWare Player. Many advanced functions make the examiners life easier: Password bypass, the use of restore points and many more.
MD5’s proprietary forensic software tool, Virtual Forensic
Computing (VFC®) is an essential tool in an investigator’s tool box. VFC saves
time and energy by helping the examiner to quickly and effortlessly recreate
the digital crime-scene, allowing the investigator to hunt around and interact
with the suspect’s desktop environment.
- Demonstrate accessibility of evidence
- Interact with software on the guest system to access:
- proprietary databases
- files with proprietary file extensions in their native environment
- Easily disprove and/or prove claims of interaction with software or the system itself.
Screen shots and screen capture video of the suspect’s
system – or even live use the software – can provide invaluable evidence in a
court of law and have helped many prosecutors to explain what may otherwise
have been highly technical evidence to non-technical audiences.