I have been using F-Response Tactical lately and wanted to share some of my thoughts. When I first encountered the Tactical product, I had to brainstorm with Matt Shannon at F-Response to understand its use cases. I spend a lot of my time doing incident response, and in that role I have used many of the enterprise forensic platforms. These tools are largely agent based, meaning a small application is run on the target system allowing raw device access to system components and communication back to a central hub for analysis. F-Response has this capability in their Consultant and Enterprise editions, and the capability has even started to filter down to some of our standard forensic suites, such as FTK 3 covered in this previous post. F-Response Tactical takes a different approach. It uses a paired set of dongles instead of agents. While limiting for some applications (such as geographically remote acquisition), it makes up for it by being dead simple to use. To start, you plug the “Subject” dongle into your target system and execute an application to begin beaconing on the network. The matched “Examiner” dongle plugs into your forensic workstation and is used to connect to the Subject. Once connected, you have full access to all physical disks, volumes, and memory on the Subject system. Since access is at the raw device level, even files traditionally locked by the filesystem can be accessed, like Exchange .edb database files, Registry hives, and System Restore Points. These items are mounted on your forensic workstation, allowing analysis using your favorite forensic software.
Live Response Applications
Continue Reading…
