F-Response Consultant + Covert

What is F-Response Consultant + Covert?

F-Response Consultant + Covert is the limited covert subject version of F-Response. Simply put, this means with F-Response Consultant + Covert edition in addition to unlimited non-covert subject computers, you may also have a single remote covert subject at any given time. F-Response Consultant + Covert leverages patented technology to provide access to remote systems over LAN and WAN networks. It creates covert, live, read-only devices on your local examiner machine suitable for forensic analysis, collection, and/or review. In addition, F-Response Consultant + Covert offers a host of data collection tools for a wide array of different 3rd party data sources including cloud storage, cloud servers, and remote network shares.

Still not sure? You'll find a video of F-Response Consultant + Covert in action below.

See F-Response Consultant + Covert in Action

How does F-Response Consultant + Covert work?

F-Response Consultant + Covert uses a patented remote connectivity technology that creates an authenticated, read-only connection between the examiner's computer and the computer(s) under inspection over any network. F-Response presents the drives, volumes, or memory (Physical Memory is supported on Windows only) of that machine as local, read-only, physical devices on your examiner machine.

F-Response Consultant + Covert is the single covert subject version of F-Response. Simply put, this means with F-Response Consultant + Covert edition you may connect to a single remote covert subject at any given time. In addition, F-Response Consultant + Covert deployment and connectivity was designed to be covert and efficient allowing the investigator to access multiple machines quickly without concern for alerting the end user.

Who would use F-Response Consultant + Covert?

For E-Discovery Professionals

F-Response Consultant + Covert was designed to give litigation teams extended geographic and technical reach to access live remote machines data in a completely write protected manner, as well as collect data from cloud storage accounts, cloud servers, and remote file shares (Network Attached Storage.)

For Forensic Investigators

F-Response Consultant + Covert includes access to remote physical disks, volumes, partitions, disk devices, allowing a forensic examiner to leverage existing tools, techniques, and methodologies to perform investigations with pinpoint accuracy and precision.

For Incident Handlers/Responders

F-Response Consultant + Covert presents remote Windows computer physical memory as a physical device. The attached device is not a snapshot of the remote physical memory, rather it represents the live physical memory of the remote machine.

F-Response Consultant + Covert Benefits

Full Deployment Capability

F-Response Enterprise offers the ability to deploy to a single remote system covertly via LAN/WAN or MSI at any given time. Deployment capability does require a dongle.

Full Live Read-Only Access, No File Level Locking

F-Response Consultant + Covert provides direct, live, read-only access to the remote target computer's disks, volumes, and in certain cases physical memory. Since all access is at the physical level there is no file level locking, F-Response gives you access to any and all content on the remote target, including protected system content (Registry files, Email PSTs, Database Files, etc).

Windows and Linux Examiner Support

F-Response includes optional installation packages which include scriptable command line components for Linux.

Optional included Imaging capability

F-Response includes optional high speed scriptable imaging (Physical images in Expert Witness "E01" format only).

F-Response Executable and Software

The F-Response functions as a single executable ("exe") on the remote target computer that requires no drivers or installation components, as well as no reboot when deployed and started. F-Response is 100% functional with the latest versions of Microsoft Windows.

Security

All subject data in transit when using F-Response Consultant + Covert is encrypted using AES 256 bit symmetric encryption.

Multi-Platform Support

Multi-platform support is included in F-Response Consultant + Covert, further extending the team's reach into Linux, Solaris, AIX, and Apple platforms. F-Response Consultant + Covert supports Apple OSX 10.3+ (Note: SIP must be disabled in 10.13+) and Linux Distributions 2002+.

Remote File Share Collection (SMB, NAS, etc.)

F-Response Consultant + Covert includes support for collecting file and folder content from remote SMB and SFTP shares. This includes both NAS devices, and remote Windows, Linux, and Apple servers. For more details on F-Response's specific SMB and SFTP collection options, please see the appropriate Mission Guide on our Mission Guides and Documentation page.

Cloud Server Collection

F-Response Consultant + Covert includes support for snapshotting and collecting Amazon EC2 and Azure Compute server volume images. For more details on F-Response's specific EC2 and Azure Compute collection options, please see the appropriate Mission Guide on our Mission Guides and Documentation page.

Cloud Files Collection

F-Response Consultant + Covert includes support for collecting cloud data from the following providers: Azure Blog Storage, Amazon Simple Storage Services (S3), Box.com for Business, Box.com for Consumers, Dropbox for Business, Dropbox for Consumers, Google Drive for Consumers, Google Mail for Consumers, Google Workspaces (Formerly GSuite), Microsoft OneDrive for Consumers, and Office365 OneDrive. For more details on F-Response's specific Cloud Files collection options, please see the appropriate Mission Guide on our Mission Guides and Documentation page.

Licensing and Usage

F-Response Consultant + Covert is sold in 1 and 3 year license terms. F-Response Consultant + Covert is limited to a single remote covert connection at any given time.

F-Response Scripting and Programming

F-Response Consultant + Covert Edition uses a simple JSON POST style RPC mechanism. This means that local scripting of F-Response is accessible from just about any scripting language that can send and receive HTTP JSON POSTs with JSON data. Learn more about the F-Response API here.

Buy F-Response Consultant + Covert

F-Response Consultant + Covert is available in 1 and 3 year license terms and can be purchased directly from F-Response.com. Buy F-Response Consultant + Covert.

IMPORTANT NOTE: Always remember, all renewal prices are available here on our website, and all licenses of F-Response automatically include maintenance, support, online training, enhancements, implementation assistance, and new releases throughout the term of your license.