Making Forensic Data acquisition more flexible
Aug 18, 2009
It occured to me while walking through the Vendor Expo at HTCIA a few weeks back how competitive the battle for "high speed" evidence acquisition and imaging has become. There were no less than four different vendors showing off hardware devices designed to perform all manner of drive duplication or image acquisition.
While I have nothing against the hardware evidence acquisition industry, and "high speed" evidence acquisition is important, I believe what we really need is more flexibility.
What I am referring to is the kind of flexibility that allows you the option of leaving the server running and acquiring the data live using whatever forensic tool you'd like backed by the speed of the local network.
Clearly, what I'm talking about the kind of flexibility F-Response provides.
But, as I've said before, it's one thing to hear me say it, so instead let me leave you with a recent customer testimonial.
"I just wanted to take a minute and thank you for your help with the two servers I had to image last Wednesday. As usual, F-Response pulled through for me again. I let the acquisitions run overnight, and when I arrived the next morning, it was a beautiful thing to see one EnCase window with a "Completed" pop-up and the other acquire with only 20min remaining (what timing!). F-Response is a fantastic product and it just keeps getting better. The only thing that can top it is the support you provide! "
Chad Gough - Director of E-Discovery, Impact Forensics
Remember, trials are completely risk free, just ask Impact Forensics, they started with a trial.
Warmest Regards,
M Shannon, Founder
F-Response