F-Response Collect
Featured
Forensic collection over unreliable network connections
Automated and script-driven evidence collection
Collection from systems that rarely connect to a corporate network
Remote imaging of disks, volumes, memory, profiles, and selected files
Collection from cloud storage, cloud servers, and network shares
Windows, Linux, and macOS collection targets
Real-time remote triage or examination
Built-in artifact parsing, analysis, or report generation
Air-gapped systems without network connectivity
Small, one-time local imaging tasks
Investigations requiring covert live access as the primary need
F-Response Collect is a server-based remote forensic collection and imaging platform designed for computers that may be located at home, on the road, or outside the organization’s primary network. It supports remote collection from Windows, Linux, and macOS systems without requiring the examiner to maintain a continuous live connection to the target.
Unlike F-Response products that provide direct access to remote evidence, Collect uses a detached tasking model. The examiner defines the collection target, and the remote subject compresses, encrypts, and uploads the requested evidence to a central server. If the network connection drops or the system reboots, the collection automatically resumes near its previous position.
Collection targets can include physical disks, logical volumes, memory, user profiles, selected files, partitions, and supported RAID devices. F-Response Collect also supports automated and scripted workflows, network-share collection, supported cloud-storage services, and server-volume collection from Amazon EC2 and Microsoft Azure.
F-Response Collect is a paid, vendor-neutral platform for automated and resumable remote forensic collection across distributed systems and evidence sources.