F-Response is an easy to use, vendor neutral, patented software utility that enables an investigator to conduct live Forensics, Data Recovery, and eDiscovery over an IP network using their tool(s) of choice. F-Response is not another analysis tool. F-Response is a utility that allows you to make better use of the tools and training that you already have.

F-Response software uses a patented process to provide read-only access to full physical disk(s), physical memory (RAM), 3rd party Cloud, Email and Database storage. Designed to be completely vendor neutral, if your analysis software reads a hard drive or network share, it will work with F-Response.


Forensically sound and secure

The examiner cannot alter Metadata, files, or make any change to the machine under inspection because all write operations are silently ignored by F-Response.

Supported platforms

Provides network accessible, authenticated, RAW, read-only drive access to most computers.


F-Response was designed to be completely vendor neutral. If your analysis software reads a hard drive, it will work with F-Response.

Highly Efficient

F-Response maintains a small active memory (RAM) Footprint and will not bog down the user’s workstation or entity’s network.


A language neutral fully scriptable JSON Web Service is available, allowing a technical user of F-Response to script actions typically initiated manually in the Management Console.


Fixed yearly license sold in 1 and 3 year increments. No seat limits. No add-ons. No surprises.


Licence Options

F-Response Universal (UNIV)

A server solution that permits many machines to be examined simultaneously over a network, and facilitates “stealthy” deployments for covert operation. F- Response Universal integrates well with standard corporate architectures. Software deployment is available to all users.

F-Response Collect (COL)

A server-based product that leverages patent-pending technology to create universal/raw images of remote windows devices from virtually anywhere. F-Response Collect provides fully scriptable and automated image collection of remote Windows assets with a focus on fully resumable imaging.


F-Response Enterprise (EE)

A dongle-based solution that permits many machines to be examined simultaneously over a network, and facilitates “stealthy” deployments for covert operation. F-Response target code is easily deployed and managed via the F-Response Enterprise Management Console (FEMC)

F-Response Consultant+Covert (CE+C)

Has all the features of Consultant edition, plus a covert, Enterprise Edition push style, deployed target for use on any one machine at any given time.

F-Response Consultant (CE)

A solution that permits many machines to be examined simultaneously. GUI-based target code is executed on each machine to be examined.

F-Response Tactical (TAC)

An intuitive, easy to use, GUI-based point solution that permits
an examiner to review one machine at a time. A matched dongle pair facilitates the automatic connection between the Examiner and Subject computers.