Frequently asked Questions, error messages, and rapid support
For more personal support, please use the chat box, email us, or call.
Q: I have an F-Response target machine that has mapped Windows drives, however F-Response is not showing me the contents of the mapped network drives as targets, why?
A: F-Response only supports presenting remote disks, volumes, and memory from a supported target machine. Network shares are not true devices and therefore would not be accessible.
Q: I have connected to a remote machine and mapped it's root drive using F-Response. However when I open up Windows Explorer and try to navigate the disk I get access denied errors when trying to access certain folders, why?
A: Windows Explorer is interpreting the structures on the attached disk and electing to apply further controls. However, using a Forensic tool against that same disk would not result in any access denied messages and all content would be accessible.
Q: I have connected to a remote machine and mapped physical disk zero using F-Response. The remote machine is Windows 8 and I am not running Windows 8 as my examiner. I have noticed my machine located the NTFS volumes on the physical disk, but I cannot open them with Windows Explorer, I get a "Disk is Read Only" error and Disk Management is marking the disks as raw. Is this a problem?
A: No, it appears that the most recent release of Windows has made a number of modifications to some of the extended NTFS structures. So much so that your examiner machine is very confused by what it sees. However, simply open a Forensic tool and point it at the physical disk and you will see the content.
Q: I am trying to use F-Response TACTICAL and I'm getting the error "The KMDF Framework is not up to date" I follow the prompts and reboot, however the result is the same, what do I do?
A: Update your TACTICAL. The most recent versions of F-Response TACTICAL address that issue and others. Use the LICENSE LOOKUP at the top right corner of the page to look up your TACTICAL and download the latest installation package.
Q: I have successfully deployed F-Response to a remote machine, however when I attempt to start F-Response using the management console (EE or CE+C) I get the following message, "Cannot connect to Validation Server.." and the remote target does not start. What do I do?
A: Don't panic! This is a simple error. In most instances this happens because the F-Response License manager is either not started on your local machine, it is blocked by a firewall ( such that the remote target cannot check with the license manager) or it is bound to an IP that is inaccessible to the remote machine. The firewall issue is readily mitigated by allowing inbound traffic to the License Manager on the default port (TCP 5681). If you find the License Manager isn't bound to an accessible IP, stop the License Manager, change the binding IP using the drop down, then restart the License Manager. At this point you will need to redeploy F-Response to your target machine (Uninstall using the Management Console) for the new License Manager IP to take effect.
Q: Can I connect to F-Response Targets from Linux?
A: Yes, there's more details on that process here.
Q: I am using F-Response Enterprise (or Consultant + Covert) and I get the following error when trying to scan a remote machine, "No Suitable Credentials found", however I don't understand why this would be the case, as I know I have valid credentials.
A: Is the remote machine not joined to a domain? If it is a workgroup machine not joined to a domain then it most likely has the Group Policy configured to downgrade all authenticated connections to Guest level access. Correcting this is different depending on the remote target's operating system. For more details lookat the Mission Guide for your specific version of F-Response. Ie. Using F-Response Enterprise with Windows Targets, and look at the troublehooting documentation at the end of the guide. All Mission Guides are here.