F-Response Imager Manual
Contents
1. Param Ssourcedevice Sdestinationpath Simagename Sexaminername Sdesc andatory true 1 5 andatory true andatory true parameter Mandatory tru parameter Mandatory Stru parameter parameter Mandatory S tru parameter parameter Sevidencenum Snotes Shash Scompression parameter Mandatory Stru parameter Mandatory Strue parameter Mandatory Strue parameter Mandatory Strue Set Variable Imaging 1 Set Variable Complete 2 Set Variable Error 5 initialize the com library Sfresponseimager New Object comObject frimagerserver FRImager start the image ImageId Sfresponseimager CreatePhysicallImage sourcedevice S destinationpath S imagename S examin ername desc casenum Sevidencenum Snotes Shash if 5 eq 0 write Error starting image check th vent logs for further information System Runtime Interopservices Marshal ReleaseComObject fresponseimager Remove Variable fresponseimager Exit 1 SImageState fresponseimager ImageState Imageld SImageLastStatus fresponseimager ImageLastStatus SImageId write Beginning Image write ImageLastStatus2. 22 Appendix Causa ER 23 Master Software License Agreement 23 Terminology The term F Response Imager refers to the Windows graphical user interface application The following terms are used throughout this manual The definitions used in this manual are as follows Physical Device Physical Device refers to the F Response connected subject s remote physical disks and logical volumes presented as locally attached physical disks Virtual Device Virtual devices refer to F Response virtual connected resources which include DiscoveryShares MemoryShares and F Response Connector Volumes Physical Image Physical Image refers to an Expert Witness EWF formatted full device acquisition Physical Images will include the allocated and unallocated content of the physical device Physical images can only be performed against Physical Devices Logical Image Logical Image refers to an Expert Witness EWF or Virtual Hard Disk VHD formatted file and folder acquisition of a virtual device Container Container refers to a list of references of user identified files and folders from either physical or virtual devices added to a user created container A container must be converted to a Expert Witness EWF or Virtual Hard Disk VHD formatted Image to actually acquire the files and folders added Supported Platforms The F Response Image
3. 10 14 2013 12 54 Configuration sett Print Edit Closing and Imaging Container via the Console Once all files and directories have been added to the Container it must be converted to an Image to copy and preserve the content requested Use the Containers gt Convert to Image menu item to begin this process Containers Show Contents Convert to Image Remove Container Format 1 Domain freswin2k8 fresponse local Password 000000000 Path for Image Files M m Compression Fast Examiner Name Examiner 1 Case Number 12567 Evidence Number 3 Unique Description Image Various Suspect Files From Container Notes Suspect XYE Image Files from Container Start Image Format E01 Expert Witness VHD Virtual Hard Disk or Both The choice of format determines what the Imager will provide at the end of the conversion process Username Domain Password As network shares and virtual devices exist only in the context of a user account you must input your credentials when starting a logical image operation Hash You must select a valid Hash MD5 or SHA1 Compression You must select a compression method All other options are optional and will be saved for your user account and re presented with each execution of the imager 20 Appendix A Legal Notices Copyright 2015 Agile Risk Management LLC
4. do Start Sleep sec 1 SImageLastStatusNew fresponseimager ImageLastStatus Imageld if ImageLastStatusNew ne ImageLastStatus write ImageLastStatusNew SImageLastStatus SImageLastStatusNew SImageState fresponseimager ImageState 1mageId while ImageState eq Imaging if 1ImageState eq Complete write Image Completed Successfully if ImageState eq SError write Image Ended with Error S fresponseimager Removelmage 1mageId ct frespons imager System Runtime Interopservices Marshal ReleaseComObj Remove Variable fresponseimager Logical Image Creating a Logical Image from the Console The F Response Imager provides the ability to make Logical Images of attached Virtual Devices DiscoveryShares MemoryShares and F Response Connector Volumes Use File Image Containers View Help the File gt New Image menu option to open a dialog for creating a new Logical Image F Response Devices 4 Devices E Virtual Devices Physical Devices WAPhysicalDrive3 i WPhysicalDrived Source Type 2 Physical Includes Unallocated Space Virtual Files and Folder Contents Only Username slynch Domain freswinZk8 fresponse local Password 00000000 Format Both Image Source F WHYPERY s3 jumbo Image Name Suspectx Z_S3Acct
5. Image Path Hash Both Total Available Space 908765MB Compression None Examiner 1 Examiner Name Case Number 12567 Evidence Number 2 Unique Description Image of Suspect s 53 Account Notes Suspect XYz Image Amazon 53 Account Start Image Cancel Creating a Logical Image requires the following dialog items be completed Source Type You must select Logical as your source type Username Domain Password As network shares and virtual devices exist only in the context of a user account you must input your credentials when starting a logical image operation Format You can create your image in Expert Witness format E01 a Virtual Hard Disk VHD or both Image Source You must select a valid network drive or virtual device from the list of available devices to be imaged Image Name You must input a valid file name for the Image you will be creating Image Path You must use the button to locate a suitable location to save your image files to image files may NOT be saved to network shares Hash You must select a valid Hash MD5 SHA1 or both Compression You have the option to enable compression of your image where Fast offers slight compression but fastest imaging speed Normal is the middle of the compression speed scale and High offers the highest compression but slower imaging time The de
6. PURPOSE ARE DISCLAIMED IN NO EVENT SHALL THE OpenSSL PROJECT ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT INDIRECT INCIDENTAL SPECIAL EXEMPLARY OR CONSEQUENTIAL DAMAGES INCLUDING BUT NOT LIMITED TO PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES LOSS OF USE DATA OR PROFITS OR BUSINESS INTERRUPTION HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY WHETHER IN CONTRACT STRICT LIABILITY OR TORT INCLUDING NEGLIGENCE OR OTHERWISE ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE This product includes cryptographic software written by Eric Young eay cryptsoft com This product includes software written by Tim Hudson tjh cryptsoft com Intel License Agreement Copyright c 2000 Intel Corporation All rights reserved Redistribution and use in source and binary forms with or without modification are permitted provided that the following conditions are met Redistributions of source code must retain the above copyright notice this list of conditions and the following disclaimer Redistributions in binary form must reproduce the above copyright notice this list of conditions and the following disclaimer in the documentation and or other materials provided with the distribution The name of Intel Corporation may not be used to endorse or promote products derived from this software without specific prior written permission THIS SOFTWARE IS PROVIDED BY THE COPYR
7. m F Response Imager Manual 2 0 1 11 Provides a complete breakdown of leveraging the F Response Imager to perform expert forensic image acquisitions Contents TERMINOLOGY ease sce TED 2 Physical DEVICES iier oreet eR nna ERE OS ERR saan erases 2 Virtual uL 2 enc Yen i eene u u 2 len V aces anew u RI MEL 2 LOGICAL T E T 2 EEEN X 2 Supported Platforms ooi tenor x S npe Irem Ere RE ERU AUNT E OVANS 2 oaa c 3 Using thie F Response Imager coke re teret er nont arn ae turned rent hr segs ving de ne Red enne oni 4 Physical IMAGE L E 4 Creating a Physical Image from the Console 4 Creating a Physical Image from Windows Explorer 7 Creating a Physical Image using COM 5 8 Logical IMAGE ERROREM 10 Creating a Logical Image from
8. based on user experience feedback Improvements to the physical image restart process Initial Release gt 1 0 0 41 22 Appendix Master Software License Agreement AGILE RISK MANAGEMENT LLC MASTER SOFTWARE LICENSE AGREEMENT TERMS AND CONDITIONS 1 Scope of Agreement Definitions This Agreement covers the license and permitted use of the Agile Risk Management LLC Agile F Response Software Unless otherwise defined in this section the capitalized terms used in this Agreement shall be defined in the context in which they are used The following terms shall have the following meanings 1 1 Agile Software or Software means any and all versions of Agile s F Response software and the related Documentation as defined below 1 2 Customer or Licensee means the person or entity identified on the invoice and only such person or entity Customer shall not mean any assigns heirs or related persons or entities or claimed third party beneficiaries of the Customer 1 3 Documentation means Agile release notes or other similar instructions in hard copy or machine readable form supplied by Agile to Customer that describes the functionality of the Agile Software 1 4 License Term means the term of the applicable license as specified on an invoice or as set forth in this Agreement 2 Grant of Software License 2 1 Enterprise License Subject to the terms and conditions of this Agreement onl
9. does not transfer to Customer any title or other ownership right or interest in any Agile Software Customer does not acquire any rights express or implied other than those expressly granted in this Agreement 23 4 Ordering amp Fulfillment Unless otherwise set forth in Agile generated Estimate pricing is set forth on the F Response website and is subject to change at any time Each order shall be subject to Agile s reasonable acceptance Unless otherwise set forth in an Agile generated Estimate Delivery terms are FOB Agile s shipping point 5 Payments Customer agrees to pay amounts invoiced by Agile for the license granted under this Agreement If any authority imposes a duty tax or similar levy other than taxes based on Agile s income Customer agrees to pay or to promptly reimburse Agile for all such amounts Unless otherwise indicated in an invoice all Agile invoices are payable thirty 30 days from the date of the invoice Agile reserves the right to charge and Customer agrees to pay Agile for every unauthorized copy or unauthorized year an amount equal to the cost per copy per year per computer or per user whichever is greater as a late payment fee in the event Customer fails to remit payments when due or Customer otherwise violates the payment provisions of this Agreement In addition to any other rights set forth in this Agreement Agile may suspend performance or withhold fulfilling new Customer orders in the ev
10. password PASS Hat HEH HH HH HEH HEH E ER Param parameter Mandatory Strue parameter Mandatory Strue parameter Mandatory Strue parameter Mandatory Strue ti x 1 gt Normal 6 High 9 Ex 1 gt FE AEE FEAE EAE EE EE EEE EE EE AE AE AE AE AE AE AE AE AE AE AE AE PE AE AE AE E AE AE AE AE AE AE PE E E E E EEE EEEE Ssourcedevice Simagename Soutformat Sdestinationpath parameter Mandatory Stru parameter Mandatory Stru parameter Mandatory Stru parameter Sexaminername Sdesc Scasenum andatory tru parameter Mandatory Strue parameter Mandatory Strue andatory true andatory tru parameter parameter Sevidencenum Snotes Shash Scompression Susername parameter Mandatory Stru parameter Mandatory Stru Set Variable Imaging 1 Set Variable Complete 2 Set Variable Error 5 initialize the com library Sdomain Spassword Sfresponseimager New Object comObject frimagerserver FRImager start the image ImageId S fresponseimager CreateLogicallmage sourcedevice S imagename S 0utformat S destinationpa th examinername Sdesc casenum evidencenum notes if 5 eq 0 Shash compression username domain Spassword write Error starting image check th vent logs for further information System Runtime Interopservices Marshal Relea
11. the Console 10 Creating a Logical Image from Windows 02 4 4 13 Creating a Logical Image using COM Scripting 01 1 14 Ea E e E 16 Creatina a 16 Adding Files and Folders to Container via the Console 17 Adding Files and Folders to a Container via Windows 18 Closing and Imaging a Container via the Console 2222 222 2 19 Appendix e 21 A E OE E m 21 Trademarks fe UTIMS 21 Statement of Rights coerente nu nhan seas es a naa be ka siapasquwsqawkaq beg es aa vage 21 Bifo e pasuasqahaakiasqamasaiaqqamuskasqamasqiasqamasqasqupaqaiuaqa ykiasqamaiaswiasqamaskasqsmasq asqa asas 21 ucl ccm 21 Appel dir D ua satan 22 Release HISLOLY
12. All rights reserved This document is protected by copyright with all rights reserved Trademarks F Response DiscoveryShare MemoryShare are trademarks of Agile Risk Management LLC All other product names or logos mentioned herein are used for identification purposes only and are the trademarks of their respective owners Statement of Rights Agile Risk Management LLC products incorporate technology that is protected by U S patent and other intellectual property IP rights owned by Agile Risk Management LLC and other rights owners Use of these products constitutes your legal agreement to honor Agile Risk Management LLC s IP rights as protected by applicable laws Reverse engineering de compiling or disassembly of Agile Risk Management LLC products is strictly prohibited Disclaimer While Agile Risk Management LLC has committed its best efforts to providing accurate information in this document we assume no responsibility for any inaccuracies that may be contained herein and we reserve the right to make changes to this document without notice Patents F Response is covered by United States Patent Numbers 8 171 108 7 899 882 9 037 630 9 148 418 and other Patents Pending 21 Appendix Release History 2 0 1 11 gt F Response Imager User Interface completely redesigned Corrections and adjustments to the internal COM scripting library to allow Container creation in script Additional modifications
13. E USE OF OR INABILITY TO USE THE SOFTWARE THE PROVISION OF OR FAILURE TO PROVIDE SUPPORT OR OTHER SERVICES INFORMATION SOFTWARE AND RELATED CONTENT THROUGH THE SOFTWARE OR OTHERWISE ARISING OUT OF THE USE OF THE SOFTWARE OR OTHERWISE UNDER OR IN CONNECTION WITH ANY PROVISION OF THIS AGREEMENT EVEN IN THE EVENT OF THE FAULT TORT INCLUDING NEGLIGENCE MISREPRESENTATION STRICT LIABILITY BREACH OF CONTRACT OR BREACH OF WARRANTY OF AGILE OR ANY SUPPLIER AND EVEN IF AGILE OR ANY SUPPLIER HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES IN NO EVENT WILL EITHER PARTY BE LIABLE TO THE OTHER PARTY OR TO ANY THIRD PARTY FOR ANY INDIRECT INCIDENTAL SPECIAL OR CONSEQUENTIAL DAMAGES INCLUDING WITHOUT LIMITATION LIABILITIES RELATED TO A LOSS OF USE PROFITS GOODWILL OR SAVINGS OR A LOSS OR DAMAGE TO ANY SYSTEMS RECORDS OR DATA WHETHER SUCH LIABILITY ARISES FROM ANY CLAIM BASED UPON CONTRACT WARRANTY TORT INCLUDING NEGLIGENCE PRODUCT LIABILITY OR OTHERWISE EVEN IF ADVISED IN ADVANCE OR AWARE OF THE POSSIBILITY OF ANY SUCH LOSS OR DAMAGE THE FOREGOING LIMITATIONS OF LIABILITY WILL NOT APPLY TO ANY OF THE FOLLOWING A A PARTY S BREACH OF ITS CONFIDENTIALITY OBLIGATIONS UNDER THIS AGREEMENT OR B ANY GROSS NEGLIGENCE OR WILLFUL MISCONDUCT BY A PARTY 25 8 3 Indemnification Licensor hereby agrees to indemnify hold harmless and defend Licensee and any partner principal employee or agent thereof against all claims liabilities losse
14. IGHT HOLDERS AND CONTRIBUTORS AS 15 AND EXPRESS OR IMPLIED WARRANTIES INCLUDING BUT NOT LIMITED TO THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED IN NO EVENT SHALL INTEL OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT INDIRECT INCIDENTAL SPECIAL EXEMPLARY OR CONSEQUENTIAL DAMAGES INCLUDING BUT NOT LIMITED TO PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES LOSS OF USE DATA OR PROFITS OR BUSINESS INTERRUPTION HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY WHETHER IN CONTRACT STRICT LIABILITY OR TORT INCLUDING NEGLIGENCE OR OTHERWISE ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE Copyright 2006 Alistair Crooks All rights reserved Redistribution and use in source and binary forms with or without modification are permitted provided that the following conditions are met 29 1 Redistributions of source code must retain the above copyright notice this list of conditions and the following disclaimer 2 Redistributions in binary form must reproduce the above copyright notice this list of conditions and the following disclaimer in the documentation and or other materials provided with the distribution 3 The name of the author may not be used to endorse or promote products derived from this software without specific prior written permission THIS SOFTWARE IS PROVIDED BY THE AUTHOR AS IS AND ANY EXPRESS OR IMPLIED WAR
15. RANTIES INCLUDING BUT NOT LIMITED TO THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT INDIRECT INCIDENTAL SPECIAL EXEMPLARY OR CONSEQUENTIAL DAMAGES INCLUDING BUT NOT LIMITED TO PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES LOSS OF USE DATA OR PROFITS OR BUSINESS INTERRUPTION HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY WHETHER IN CONTRACT STRICT LIABILITY OR TORT INCLUDING NEGLIGENCE OR OTHERWISE ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE Copyright c 2011 2014 Loic Hoguin lt essen ninenines eu gt Permission to use copy modify and or distribute this software for any purpose with or without fee is hereby granted provided that the above copyright notice and this permission notice appear in all copies THE SOFTWARE IS PROVIDED AS IS AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL DIRECT INDIRECT OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE DATA OR PROFITS WHETHER IN AN ACTION OF CONTRACT NEGLIGENCE OR OTHER TORTIOUS ACTION ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE Copyright 2009 2011 Andrew Thompson lt andrew hijacked us gt All rights reserved Re
16. al Devices directly from Windows Explorer This patent pending feature can be leveraged using the right click context menu from any network share presented by Windows Explorer Suspect B Www 0 bytes free of 9 53 Open new window E Restore previous versions F Response Imager Create Forensic Image Creating Logical Image using COM Scripting Logical Images can be created directly from any scripting language that supports COM Included below is a sample script for creating a Logical Image using Powershell Author Shannon usage logical imager script psl examinername EXAMINER Ex Joe casenum CASENUM Ex 123 gt HEE HEE EH EE HH EH EH FE HE TE FE HH EE HEE HH HEE FE HEE a EE EEE HEE EE EEE ERE E ERE EN F Response Imager Script for imaging a logical device network share Pre requisites F Response Imager sourcedevice lt X gt imagename lt IMAGENAME Ex XYZImage outformat lt 0 1 VHD 2 Both 3 Ex 1 gt destinationpath lt DESTINATIONPATH Ex E gt Examiner desc DESCRIPTION Ex Some Image gt evidencenum EVIDENCENUMBER Ex Evidence123 notes NOTES Ex Some Notes gt hash Md5 1 Shal 2 Both 3 compression None 0 Fast 1 username USERNAME domain DOMAIN
17. ath M Hash Both Total Available Space 915088MB Compression Fast Examiner Name Examiner 1 Case Number 12567 Evidence Number 1 Unique Description Image physical Drive3 Notes Suspect XTY Image Physical Drive3 Start Image Cancel Creating a Physical Image requires the following dialog items be completed Source Type You must select Physical as your source type Image Source You must select a valid F Response drive from the list of available drives and volumes to be imaged Image Name You must input a valid file name for the Image you will be creating Image Path You must use the button to locate a suitable location to save your image files to image files may NOT be saved to network shares Hash You must select a valid Hash MD5 SHA1 or both Compression You have the option to enable compression of your image where Fast offers slight compression but fastest imaging speed Normal is the middle of the compression speed scale and High offers the highest compression but slower imaging time The default setting is None if compression of the image is not needed All other fields are optional and will be saved for your user account and re presented with each execution of the imager Active Images Name Source Device Last Status Examplelmage PhysicalDisk1 PhysicalDrivel 16 Active imaging operation
18. ces Clear Messages Exit Container Path O Once you have created container you can find it under the Containers the Console Containers x Name SampleContainer Double click on it to open Adding Files and Folders to a Container via the Console Container Entry Add Directory Remove Entry Refresh Convert to Image Add File Adds a new File to the Container This is a reference to the file only no actual files are copied until the container has been converted to an Image Add Directory Adds a new Directory to the Container This is a reference to the directory only no actual directories or their content are copied to until the container has been converted to an image Added Directories are considered recursive therefore all child items will be added automatically during the conversion to an Image Remove Entry Removes a File or Directory from the Container Refresh Will refresh the list of files and folders currently in the Container Convert to Image Will close the Container and open the Create Image dialog where the details of the image can be specified Adding Files and Folders to a Container via Windows Explorer The F Response Image provides the ability to add files and directories to Containers via Windows Explorer This patent pending feature can be leveraged using the right click context menu from any file or directory presented by Windows Explorer
19. ces if any and they supersede all prior or contemporaneous oral or written communications proposals and representations with respect to the Software or any other subject matter covered by this Agreement To the extent the terms of any Agile policies or programs for support services conflict with the terms of this Agreement the terms of this Agreement shall control This Agreement shall be governed by the laws of the State of Florida USA without regard to choice of law provisions You and Agile agree to submit to the personal and exclusive jurisdiction of the Florida state court located in Tampa Florida and the United States District Court for the Middle District of Florida If any provision of this Agreement is held to be illegal or unenforceable for any reason then such provision shall be deemed to be restated so as to be enforceable to the maximum extent permissible under law and the remainder of this Agreement shall remain in full force and effect Customer and Agile agree that this Agreement shall not be governed by the U N Convention on Contracts for the International Sale of Goods 26 11 3 Notices Any notices under this Agreement will be personally delivered sent by certified or registered mail return receipt requested or by nationally recognized overnight express courier to the address specified herein or such other address as a Party may specify in writing Such notices will be effective upon receipt which may be shown by conf
20. distribution and use in source and binary forms with or without modification are permitted provided that the following conditions are met 1 Redistributions of source code must retain the above copyright notice this list of conditions and the following disclaimer 2 Redistributions in binary form must reproduce the above copyright notice this list of conditions and the following disclaimer in the documentation and or other materials provided with the distribution THIS SOFTWARE IS PROVIDED BY THE PROJECT 5 IS AND ANY EXPRESS OR IMPLIED WARRANTIES INCLUDING BUT NOT LIMITED TO THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT INDIRECT INCIDENTAL SPECIAL EXEMPLARY OR CONSEQUENTIAL DAMAGES INCLUDING BUT NOT LIMITED TO PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES LOSS OF USE DATA OR PROFITS OR BUSINESS INTERRUPTION HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY WHETHER IN CONTRACT STRICT LIABILITY OR TORT INCLUDING NEGLIGENCE OR OTHERWISE ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE Copyright c 2000 2010 Marc Alexander Lehmann lt schmorp schmorp de gt Redistribution and use in source and binary forms with or without modification are permitted provided that the following conditions are met 30 1 Redistributions of source code must retai
21. ent Customer has failed to timely remit payment for outstanding and past due invoices 6 Confidentiality 6 1 Definition Confidential Information means a any non public technical or business information of a party including without limitation any information relating to a party s techniques algorithms software know how current and future products and services research engineering vulnerabilities designs financial information procurement requirements manufacturing customer lists business forecasts marketing plans and information b any other information of a party that is disclosed in writing and is conspicuously designated as Confidential at the time of disclosure or that is disclosed orally and is identified as Confidential at the time of disclosure or c the specific terms and conditions of this Agreement 6 2 Exclusions Confidential Information shall not include information which i is or becomes generally known to the public through no fault or breach of this Agreement by the receiving Party ii the receiving Party can demonstrate by written evidence was rightfully in the receiving Party s possession at the time of disclosure without an obligation of confidentiality iii is independently developed by the receiving Party without use of or access to the disclosing Party s Confidential Information or otherwise in breach of this Agreement iv the receiving Party rightfully obtains from a third par
22. fault setting is None if compression of the image is not needed 11 All other fields are optional they will be saved for your user account and will appear with each execution of the Imager Active Images Name Source Device Last Status ie SuspectS3Account WIN8 DEV X64 s3 standard Copying If the image completes successfully it will be removed from the Active Images panel and will appear in the Completed Images panel There are multiple options for a completed Image including Completed Images Name Source WAVolume de69f949 690a 1165 8253 000c29be9ea2 Name SuspectS3Account Source 2 Volume de69f949 690a 1165 8253 000c29be9ea2 Destination G Description Image of Suspect s 3 Acct MD5 3ba0e50add429cba56a71ea011103e04 5 1 0000000000000000000000000000000000000000 Remove Image Removes the Image from the F Response Imager This does not delete the image or resultant log files it only removes the Imager from the F Response Imager console Open Image Path Use this option to open Windows Explorer directly to the location of the newly created Image file s Open Image Log Use this option to open the Image log file directly Open Image FileList Use this option to open a listing of the files copied during the image Logical and Container Images only Creating a Logical Image from Windows Explorer The F Response Image provides the ability to make Logical Images of F Response attached Virtu
23. h terms and conditions shall be void and have no effect and the provisions of this Agreement shall control Unless otherwise expressly set forth in an exhibit that is executed by the Parties this Agreement shall control the event of any conflict with an exhibit Sections 2 3 5 7 8 and 9 and all warranty disclaimers use restrictions and provisions relating to Agile s intellectual property ownership shall survive the termination or expiration of this Agreement The Parties are independent contractors for all purposes under this Agreement 11 8 Changes to this agreement Agile will entertain changes to this agreement on a case by case basis Changes to this Agreement may require that the Customer pay an additional administrative fee depending on the scope and complexity of the changes required by the Customer The additional administrative fee if any must be paid before the license will be activated 31
24. iability and Remedies NOTWITHSTANDING ANY DAMAGES THAT YOU MIGHT INCUR FOR ANY REASON WHATSOEVER INCLUDING WITHOUT LIMITATION ALL DAMAGES REFERENCED ABOVE AND ALL DIRECT OR GENERAL DAMAGES IN CONTRACT OR ANY OTHER THEORY IN LAW OR IN EQUITY THE ENTIRE LIABILITY OF EITHER PARTY AND WITH RESPECT TO AGILE ANY OF ITS SUPPLIERS UNDER ANY PROVISION OF THIS AGREEMENT AND THE EXCLUSIVE REMEDY HEREUNDER SHALL BE LIMITED TO THREE TIMES THE TOTAL AMOUNT PAID BY CUSTOMER FOR THE LICENSE PROVIDED HOWEVER THAT THIS LIMITATION DOES NOT APPLY TO ANY OF THE FOLLOWING A A PARTY S BREACH OF ITS CONFIDENTIALITY OBLIGATIONS UNDER THIS AGREEMENT OR B ANY GROSS NEGLIGENCE OR WILLFUL MISCONDUCT BY A PARTY THE FOREGOING LIMITATIONS EXCLUSIONS AND DISCLAIMERS SHALL APPLY TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW EVEN IF ANY REMEDY FAILS ITS ESSENTIAL PURPOSE 8 2 Exclusion of Incidental Consequential and Certain Other Damages TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW IN NO EVENT SHALL EITHER PARTY AND WITH RESPECT TO AGILE ITS SUPPLIERS BE LIABLE TO THE OTHER FOR ANY SPECIAL INCIDENTAL PUNITIVE INDIRECT OR CONSEQUENTIAL DAMAGES WHATSOEVER INCLUDING BUT NOT LIMITED TO DAMAGES FOR LOSS OF PROFITS FOR BUSINESS INTERRUPTION FOR PERSONAL INJURY FOR LOSS OF PRIVACY FOR FAILURE TO MEET ANY DUTY INCLUDING OF GOOD FAITH OR OF REASONABLE CARE AND FOR ANY OTHER PECUNIARY OR OTHER LOSS WHATSOEVER ARISING OUT OF OR IN ANY WAY RELATED TO TH
25. inadequate to compensate the non breaching Party In the event of a breach or threatened breach of any of the provisions of this section the non breaching Party in addition to and not in limitation of any other rights remedies or damages available to it at law or in equity shall be entitled to a temporary restraining order preliminary 24 injunction and or permanent injunction in order to prevent to restrain any such breach by other Party 7 DISCLAIMER OF WARRANTIES TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW AGILE AND ITS SUPPLIERS PROVIDE THE SOFTWARE AND SUPPORT SERVICES IF ANY AS IS AND WITH ALL FAULTS AND HEREBY DISCLAIM ALL OTHER WARRANTIES AND CONDITIONS WHETHER EXPRESS IMPLIED OR STATUTORY INCLUDING BUT NOT LIMITED TO ANY IF ANY IMPLIED WARRANTIES DUTIES OR CONDITIONS OF MERCHANTABILITY OF FITNESS FOR A PARTICULAR PURPOSE OF RELIABILITY OR AVAILABILITY OF ACCURACY OR COMPLETENESS OF RESPONSES OF RESULTS OF WORKMANLIKE EFFORT OF LACK OF VIRUSES AND OF LACK OF NEGLIGENCE ALL WITH REGARD TO THE SOFTWARE AND THE PROVISION OF OR FAILURE TO PROVIDE SUPPORT OR OTHER SERVICES INFORMATION SOFTWARE AND RELATED CONTENT THROUGH THE SOFTWARE OR OTHERWISE ARISING OUT OF THE USE OF THE SOFTWARE ALSO THERE IS NO WARRANTY OR CONDITION OF TITLE QUIET ENJOYMENT QUIET POSSESSION CORRESPONDENCE TO DESCRIPTION OR NON INFRINGEMENT WITH REGARD TO THE SOFTWARE 8 Limitations and Exclusions 8 1 Limitation of L
26. irmation of delivery 11 4 Assignment Customer may not assign or otherwise transfer this Agreement without the Agile s prior written consent which consent shall not be unreasonably withheld conditioned or delayed This Agreement shall be binding upon and inure to the benefit of the Parties successors and permitted assigns if any 11 5 Force Majeure Neither Party shall be liable for any delay or failure due to a force majeure event and other causes beyond its reasonable control This provision shall not apply to any of Customer s payment obligations 11 6 Redistribution Compliance a F Response distributes software libraries developed by The Sleuth Kit TSK The license information and source code for TSK can be found at www sleuthkit org If any changes have been made by Agile to the TSK libraries distributed with the F Response software those changes can be found online at http www f response com TSKinfo b A portion of the F Response Software was derived using source code provided by multiple 3rd parties which requires the following notices be posted herein and which applies only to the source code F Response code is distributed only in binary or object code form F Response source code and any revised 3rd party code contained within the F Response source code is not available for distribution The name of 3rd parties included below are not being used to endorse or promote this product nor is the name of
27. n the above copyright notice this list of conditions and the following disclaimer 2 Redistributions in binary form must reproduce the above copyright notice this list of conditions and the following disclaimer in the documentation and or other materials provided with the distribution THIS SOFTWARE IS PROVIDED BY THE AUTHOR AS IS AND ANY EXPRESS OR IMPLIED WARRANTIES INCLUDING BUT NOT LIMITED TO THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT INDIRECT INCIDENTAL SPECIAL EXEMPLARY OR CONSEQUENTIAL DAMAGES INCLUDING BUT NOT LIMITED TO PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES LOSS OF USE DATA OR PROFITS OR BUSINESS INTERRUPTION HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY WHETHER IN CONTRACT STRICT LIABILITY OR TORT INCLUDING NEGLIGENCE OR OTHERWISE ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE 11 7 General This Agreement including its exhibits all of which are incorporated herein are collectively the Parties complete agreement regarding its subject matter superseding any prior oral or written communications Amendments or changes to this Agreement must be in mutually executed writings to be effective The Parties agree that to the extent any Customer purchase or sales order contains terms or conditions that conflict with or supplement this Agreement suc
28. odification are permitted provided that the following conditions are met 1 Redistributions of source code must retain the above copyright notice this list of conditions and the following disclaimer 2 Redistributions in binary form must reproduce the above copyright notice this list of conditions and the following disclaimer in the documentation and or other materials provided with the distribution 3 All advertising materials mentioning features or use of this software must display the following acknowledgment This product includes software developed by the OpenSSL Project for use in the OpenSSL Toolkit http www openssl org 4 The names OpenSSL Toolkit and OpenSSL Project must not be used to endorse or promote products derived from this software without prior written permission For written permission please contact openssl core openssl org 5 Products derived from this software may not be called OpenSSL nor may OpenSSL appear in their names without prior written permission of the OpenSSL Project 6 Redistributions of any form whatsoever must retain the following acknowledgment This product includes software developed by the OpenSSL Project for use the OpenSSL Toolkit http www openssl org THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT 5 IS AND ANY EXPRESSED OR IMPLIED WARRANTIES INCLUDING BUT NOT LIMITED TO THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 28
29. ork locations 2 Documents 22 Suspect Downloads O o v a Open 4 Music gt Open in new window 15 items 1 item selected Restore previous versions F Response Imager s Create Forensic Image Creating a Physical Image using COM Scripting Physical Images of F Response presented devices can be created directly from any scripting language that supports COM Included below is a sample script for creating a Physical Image using Powershell FEFE AE FE TE FE AE FE E TE HE FE FE HEFE FE FE FE TE FE TE FE AE TE FE HEE HE FE FE FE FE TE FE AE FE AE TE HE HE FE HE FE FE FE FE TE FE AE TE E TE FE E AE HE FE FE FE FE TE FE AE TE AE TE FE HEFE HE FE FE E AE E E E E E E F Response Imager Script for imaging a physical device Pre requisites F Response Imager Author M Shannon usage physical imager script psl sourcedevice lt X or NN NPhysicalDriveX gt destinationpath lt DESTINATIONPATH Ex E gt imagename lt IMAGENAME Ex XYZImage gt examinername EXAMINER Ex Joe Examiner desc DESCRIPTION Ex Some Image Desc casenum CASENUM Ex Casel23 evidencenum EVIDENCENUMBER Ex Evidencel23 gt notes NOTES Ex Some Notes hash Md5 1 Shal 2 Both 3 Ex 1 compression None 0 Fast 1 Normal 6 High 9 Ex 1 gt
30. page or in other Agile provided materials Any software Agile may provide you as part of support services are governed by this Agreement unless separate terms are provided 10 2 Consent to Use of Data You agree that Agile and its affiliates may collect and use technical information gathered as part of the support services provided to you if any related to the Software Agile may use this information solely to improve our products or to provide customized services or technologies to you and will not disclose this information in a form that personally identifies you 11 Miscellaneous 11 1 Legal Compliance Restricted Rights Each Party agrees to comply with all applicable Laws Without limiting the foregoing Customer agrees to comply with all U S export Laws and applicable export Laws of its locality if Customer is not located in the United States and Customer agrees not to export any Software or other materials provided by Agile without first obtaining all required authorizations or licenses In the event the Software is provided to the United States government it is provided with only LIMITED RIGHTS and RESTRICTED RIGHTS as defined in FAR 52 227 14 if the commercial terms are deemed not to apply 11 2 Governing Law Severability This Agreement including any addendum or amendment to this Agreement which is included with the Software are the entire agreement between you and Agile relating to the Software and the support servi
31. r executables are designed to function properly on the following Microsoft Windows versions 7 2008 200812 8 1 2012 and 10 64 bit only Overview The F Response Imager is a patent pending F Response Imaging product developed to provide simple fast and full operating system level integrated imaging for F Response customers File Image Containers View Help Errored Images Source Device Last Status Virtual Devices fl bs ad Physical Devices Completed Images Name Source i Pmem2 WAVolume f8394d13 2ee4 1165 8255 005056b15d5e x pmemx64wi AVolume f8394d13 2ee4 11e 15d5e Using the F Response Imager Physical Image Creating a Physical Image from the Console The F Response Imager provides the ability to make Physical Images of attached F Response presented physical devices Use the File gt New Image menu option File Image Containers View Help or simply double click on an F Response attached physical F Response Devices device to open a dialog for creating a new Physical Image F Response Devices oa Virtual Devices a 4 Physical Devices WaAPhysicalDrive3 12 WeAPhysicalDrived Source Type 9 Physical Includes Unallocated Space Virtual Files and Folder Contents Only Username slynch Domain freswin2k8 fresponse loca Password Format Image Source MA PhysicalDrive3 Image Name ExampleImage PhysicalDisk3 Image P
32. s expenses including attorney s fees and legal expenses related to such defense fines penalties taxes or damages collectively Liabilities asserted by any third party where such Liabilities arise out of result from 1 any claim that the Software or Customer s use thereof violates any copyright trademark patent and or any other intellectual property rights 2 the negligence of Licensor in the course of providing any Services hereunder or 3 the representations or warranties made by Licensor hereunder or their breach Licensee shall promptly notify Licensor of any third party claim and Licensor shall at Licensee s option conduct the defense in any such third party action arising as described herein at Licensor s sole expense and Licensee shall cooperate with such defense 9 Verification 9 1 Agile has the right to request Customer complete a self audit questionnaire a form provided by Agile If an audit reveals unlicensed use of the Agile Software Customer agrees to promptly order and pay for licenses to permit all past and ongoing usage 10 Support Services 10 1 Rights and Obligations This Agreement does not obligate Agile to provide any support services or to support any software provided as part of those services If Agile does provide support services to you use of any such support services is governed by the Agile policies and programs described in the user manual in online documentation on Agile s support web
33. s will appear in the Active Images panel The Last Status field will update as the image operation progresses If the image completes successfully it will be removed from the Active Images panel and will appear in the Completed Images panel There are multiple options for a completed Image including Completed Images Name Source p Examplelmage Physicalgs Stop Image Remove Image Restart Physical Image Open Image Path Open Image Log Open Image FileList Remove Image Removes the Image from the F Response Imager This does not delete the image or resultant log files it only removes the Imager from the F Response Imager console Open Image Path Use this option to open Windows Explorer directly to the location of the newly created Image file s Open Image Log Use this option to open the Image log file directly Open Image FileList Use this option to open a listing of the files copied during the image Logical and Container Images only Creating a Physical Image from Windows Explorer The F Response Imager provides the ability to make Physical Images of attached F Response presented physical devices directly from Windows Explorer This patent pending feature can be leveraged using the right click context menu from any F Response presented fixed or removable disk in Windows Explorer E Recent places Destination M 8 55 GB free of 9 99 GB This PC 3B free o GB je Desktop 4 Netw
34. seComObject fresponseimager Remove Variable fresponseimager 14 Exit 1 SImageState S fresponseimager ImageState ImageId SImageLastStatus fresponseimager ImageLastStatus SImageId write Beginning Image write ImageLastStatus do whil Start Sleep sec 10 SImageLastStatusNew fresponseimager ImageLastStatus Imageld if ImageLastStatusNew ne ImageLastStatus write S ImageLastStatusNew SImageLastStatus SImageLastStatusNew SImageState fresponseimager ImageState 1mageId SImageState eq Imaging if SImageState eq Complete if write Image Completed Successfully 1mageState eq SError write Image Ended with Error S fresponseimager Removelmage 1mageId System Runtime Interopservices Marshal ReleaseComObject fresponseimager Remove Variable fresponseimager 15 Container Creating a Container The F Response Imager provides the ability to make a Container of Files and Folders from attached devices both physical and virtual Use the File gt New Container menu File Image Containers View Help option to open a dialog for creating a new Container New Image Containers contain only references to the files and folders New Container added to them A container must be converted to an image to actually acquire the files and folders added Refresh Images and Containers Refresh Devi
35. the author being used to endorse or promote this product This information is presented solely to comply with the required license agreements which require reproduction of the following copyright notice list of conditions and disclaimer Copyright c 2009 2014 Petri Lehtinen lt petri digip org gt Permission is hereby granted free of charge to any person obtaining a copy of this software and associated documentation files the Software to deal in the Software without restriction including without limitation the rights to use copy modify merge publish distribute sublicense and or sell copies of the Software and to permit persons to whom the Software is furnished to do so subject to the following conditions The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software THE SOFTWARE IS PROVIDED AS IS WITHOUT WARRANTY OF ANY KIND EXPRESS OR IMPLIED INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM DAMAGES OR OTHER 27 LIABILITY WHETHER IN AN ACTION OF CONTRACT TORT OR OTHERWISE ARISING FROM OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE Copyright c 1998 2011 The OpenSSL Project All rights reserved Redistribution and use in source and binary forms with or without m
36. ty not under a duty of confidentiality and without restriction on use or disclosure or v is required to be disclosed pursuant to or by any applicable laws rules regulatory authority court order or other legal process to do so provided that the Receiving Party shall promptly upon learning that such disclosure is required give written notice of such disclosure to the Disclosing Party 6 3 Obligations Each Party shall maintain in confidence all Confidential Information of the disclosing Party that is delivered to the receiving Party and will not use such Confidential Information except as expressly permitted herein Each Party will take all reasonable measures to maintain the confidentiality of such Confidential Information but in no event less than the measures it uses to protect its own Confidential Information Each Party will limit the disclosure of such Confidential Information to those of its employees with a bona fide need to access such Confidential Information in order to exercise its rights and obligations under this Agreement provided that all such employees are bound by a written non disclosure agreement that contains restrictions at least as protective as those set forth herein 6 4 Injunctive Relief Each Party understands and agrees that the other Party will suffer irreparable harm in the event that the receiving Party of Confidential Information breaches any of its obligations under this section and that monetary damages will be
37. y Agile grants Customer a non exclusive non transferable license to install the Agile Software and to use the Agile Software during the License Term in object code form only 2 2 Third Party Software Customer acknowledges that the Agile Software may include or require the use of software programs created by third parties and the Customer acknowledges that its use of such third party software programs shall be governed exclusively by the third party s applicable license agreement 3 Software License Restrictions 3 1 No Reverse Engineering Other Restrictions Customer shall not directly or indirectly i sell license sublicense lease redistribute or transfer any Agile Software ii modify translate reverse engineer decompile disassemble create derivative works based on or distribute any Agile Software iii rent or lease any rights in any Agile Software in any form to any entity iv remove alter or obscure any proprietary notice labels or marks on any Agile Software Customer is responsible for all use of the Software and for compliance with this Agreement and any applicable third party software license agreement 3 2 Intellectual Property Agile retains all title patent copyright and other intellectual proprietary rights in and ownership of the Agile Software regardless of the type of access or media upon which the original or any copy may be recorded or fixed Unless otherwise expressly stated herein this Agreement
Download Pdf Manuals
Related Search