Frequently Asked Questions

Frequently asked Questions, error messages, and rapid support

For more personal support, please use the chat box, email us, or call.

Q: I have an F-Response target machine that has mapped Windows drives, however F-Response is not showing me the contents of the mapped network drives as targets, why?

A: F-Response only supports presenting remote disks, volumes, and memory from a supported target machine. Network shares are not true devices and therefore would not be accessible.

Q: I have connected to a remote machine and mapped it's root drive using F-Response. However when I open up Windows Explorer and try to navigate the disk I get access denied errors when trying to access certain folders, why?

A: Windows Explorer is interpreting the structures on the attached disk and electing to apply further controls. However, using a Forensic tool against that same disk would not result in any access denied messages and all content would be accessible.

Q: Does F-Response support Bitlocker?

A: Bitlocker support is largely a function of the OS. We recommend using Windows 10 for your examiner machine to recognize and prompt for the password when connecting to a remote Bitlocker disk using F-Response.

Q: I have connected to a remote machine and mapped physical disk zero using F-Response. The remote machine is Windows 8 and I am not running Windows 8 as my examiner. I have noticed my machine located the NTFS volumes on the physical disk, but I cannot open them with Windows Explorer, I get a "Disk is Read Only" error and Disk Management is marking the disks as raw. Is this a problem?

A: No, it appears Windows 8 has made a number of modifications to some of the extended NTFS structures. So much so that your examiner machine is very confused by what it sees. However, simply open a forensic tool and point it at the physical disk and you will see the content.

Q: I have successfully deployed F-Response to a remote machine, however when I attempt to start F-Response using the management console (EE or CE+C) I get the following message, "Unable to connect to the license manager from [subjectname].Please check for firewall or port restrictions." and the remote target does not start. What do I do?

A: Don't panic! This is a simple error. In most instances this happens because the F-Response License manager is blocked by a firewall (usually the firewall on the examiner computer, such that the remote target cannot check with the license manager to start) or the IP of the examiner computer has changed since the software was deployed to the subject (I.e., Examiner laptop rebooted and obtained a new IP on boot). The firewall issue is readily mitigated by allowing inbound traffic to the License Manager on the default port (TCP 5682). If the IP of the license manager has changed since deployment, you need to uninstall and redeploy F-Response for the new License Manager IP to take effect.

Q: I am using F-Response Enterprise (or Consultant + Covert) and I get the following error when trying to scan a remote machine, "No Suitable Credentials found", however I don't understand why this would be the case, as I know I have valid credentials.

A: Is the remote machine not joined to a domain? If it is a workgroup machine not joined to a domain then it most likely has the Group Policy configured to downgrade all authenticated connections to Guest level access. Correcting this is different depending on the remote target's operating system. For more details lookat the Mission Guide for your specific version of F-Response. Ie. Using F-Response Enterprise with Windows Targets, and look at the troublehooting documentation at the end of the guide. All Mission Guides are here.