F-Response Manual

Transcription

1 F-Respnse Manual Prvides a cmplete breakdwn f leveraging F-Respnse Enterprise, Cnsultant + Cvert, Cnsultant, r Field Kit Editin t perfrm expert remte cmputer frensics and incident respnse. 1

2 Table f Cntents Table f Cntents... 2 Welcme t F-Respnse... 5 Terminlgy... 5 Target... 5 Initiatr... 5 Supprted Platfrms... 6 Prerequisites... 8 F-Respnse License FOB... 9 Getting started with F-Respnse Enterprise Editin Cnsultant + Cvert Editin Cnsultant Editin Field Kit Editin Licensing F-Respnse Using the F-Respnse License Manager Sftware (CE and EE Only) Installing and starting the F-Respnse License Manager F-Respnse Cnnectr (Clud Strage Using the F-Respnse Cnnectr fr Clud Strage Targets (TAC, CE, CE+C, and EE) Cnfiguring Clud Strage Optins Cnfiguring Clud Strage Credentials Scanning fr Clud Strage Targets Cnnecting t Clud Strage Targets Discnnecting frm Clud Strage Targets F-Respnse Cnnectr (Database Objects) Using the F-Respnse Cnnectr fr Database Objects, Sharepint (TAC, CE, CE+C, and EE) Cnfiguring Database Server Credentials Scanning fr Database Object Targets Cnnecting t Database Object Targets Discnnecting frm Database Object Targets F-Respnse Cnnectr ( )

3 Using the F-Respnse Cnnectr fr (TAC, CE, CE+C, and EE) Cnfiguring Cnnectr Optins Cnfiguring Credentials Scanning fr Accunt Targets Cnnecting t Accunt Targets Discnnecting frm Accunt Targets F-Respnse Enterprise Enterprise Editin Overview f the F-Respnse Enterprise Management Cnsle (FEMC) Enterprise Editin Cnfiguring the FEMC Deplyment Optins Enterprise Editin Cnfiguring the FEMC Credentials Enterprise Editin Scanning Enterprise Editin Deplying and Managing F-Respnse using the FEMC (All Supprted Platfrms) Enterprise Editin Using F-Respnse Enterprise Editin fr Windws (Deplyment withut the FEMC) F-Respnse Cnsultant + Cvert Editin Cnsultant + Cvert Editin Overview F-Respnse Cnsultant Editin Cnsultant Editin Overview f the F-Respnse Cnsultant Cnnectr Cnsultant Editin Cnfiguring the FCC Cnsle (Quick Cnfigure) Cnsultant Editin Cnfiguring the FCC Cnsle (Create AutCnfigure) Cnsultant Editin Using F-Respnse Cnsultant Editin fr Windws Cnsultant Editin Using F-Respnse Cnsultant Editin fr Unix based Targets F-Respnse cmmand line help n analyst machine Cnsultant Editin Using the F-Respnse Cnsultant Cnnectr F-Respnse Acceleratr (Cnsultant, Cnsultant + Cvert, and Enterprise Only) Field Kit Editin F-Respnse Field Kit Editin Using F-Respnse Field Kit Editin fr Windws F-Respnse Field Kit Editin Using F-Respnse Field Kit Editin fr Unix (Linux, Apple OS X) F-Respnse Field Kit Editin Cnnecting t an F-Respnse Target F-Respnse Field Kit Editin Discnnecting frm an F-Respnse Target F-Respnse Flexdisk

4 What is a F-Respnse Flexdisk? Hw d I access and use a F-Respnse Flexdisk? Frequently Asked Questins Supprt Linux License Manager and Acceleratr Missin Guides Sftware Revisin Histry Appendix A Overview f the F-Respnse Enterprise Editin Windws Cmmand Line Interface Appendix B Overview f the F-Respnse Enterprise Editin Unix Cmmand Line Interface Appendix C Overview f the F-Respnse Cnsultant User Interface Appendix D Overview f the F-Respnse Field Kit User Interface Appendix E Understanding Unix Credentials Appendix F Sftware Requirements n the Target Cmputer Appendix G F-Respnse Target Naming Cnventin Appendix H -- Icn Legend Appendix I Master Sftware License Agreement Appendix J Renewing F-Respnse Dngle License Updating the F-Respnse Dngle (FK,CE,CE+C,EE) Purpse What Yu Need Appendix K Legal Ntices Legal Ntice Trademarks Statement f Rights Disclaimer Patents

5 Welcme t F-Respnse Thank yu fr purchasing F-Respnse. Yu have nw extended the capabilities f yur existing arsenal f tls t enable them t wrk ver an IP netwrk. F-Respnse accmplishes this thrugh the use f a patented prcess (US 7,899,882 US 8,171,108 and patents pending); a part f which includes leveraging the Internet Small Cmputer Systems Interface (iscsi) prtcl standard as defined in RFC 3720 ( Terminlgy The iscsi terms Target and Initiatr are used thrughut this manual. The chice f initiatr and target verbiage in the iscsi definitins may prve cnfusing t frensics practitiners because target carries a different definitin in the field f cmputer frensics versus iscsi. In cmputer frensics, the system t be analyzed is generally referred t as the subject system, whereas the system t which frensically sund data is cllected is generally referred t as the target system. In this manual, the frensic subject is an iscsi target, i.e. F-Respnse Target cde is executed n the machine t be analyzed. Fr this reasn, we want t make clear that the use f the wrd target in this manual refers t the iscsi definitin, and nt the frensics definitin. The definitins fr Target and Initiatr used in this manual are as fllws: Target F-Respnse Target cde is t be executed n the machine(s) t be analyzed. All references t target in this manual refer t the machine(s) being analyzed using F- Respnse target cde. Initiatr An iscsi initiatr is used t establish netwrk cnnectins t machines running F- Respnse Target cde. iscsi initiatr sftware must be installed n the machine frm which analysis is t be cnducted ver the netwrk. F-Respnse Target cde has been tested with Micrsft iscsi Initiatr 2.0 sftware, included by default with newer Windws perating systems, and freely available fr dwnlad frm the Micrsft web site. 5

6 Supprted Platfrms The F-Respnse stand alne executable is capable f prviding remte frensically sund read nly physical hard drive cnnectivity n the fllwing platfrms: Platfrms supprted by all versins f F-Respnse (Field Kit, Cnsultant, Cnsultant + Cvert, & Enterprise) Windws XP, 2003 Windws Vista, 2008 (32 & 64bit) Windws 7, 2008r2 (32 & 64bit) Windws 8/8.1, 2012/2012r2 (32bit & 64bit) Linux (Glibc ) 1 Apple OS X (10.3, 10.4, 10.5, 10.6, 10.7, 10.8, 10.9, Intel 2 Only) Additinal Platfrms supprted by F-Respnse Cnsultant, Cnsultant + Cvert, and Enterprise nly Apple OS X (10.3+ Universal Binary) Sun Slaris (8, 9, 10) n SPARC OpenSlaris, Oracle Slaris 11 n Intel IBM AIX (5.1+) n Pwer FreeBSD (7,8) n Intel i386,x64 F-Respnse Flexdisk Supprted 3 Platfrms (Cnsultant, Cnsultant + Cvert, and Enterprise) Windws XP, 2003 Windws Vista, 2008 (32 & 64bit) Windws 7, 2008r2 (32bit & 64bit) Windws 8/8.1, 2012/2012r2 (32bit & 64bit) Linux (Glibc ) (32bit and 64bit) Apple OS X (10.3+ Universal Binary) 1 Linux glibc includes Redhat, Suse, Ubuntu, Fedra, and many ther distributins f Linux released during r after Intel nly fr Field Kit, all thers are Universal Binary. 3 Platfrm supprt is further restricted t supprted filesystems, ext2, ext3, ntfs, fat, hfs, hfs+ 6

7 F-Respnse Cnnectr (TACTICAL Versin) Clud Prviders Amazn Web Services Simple Strage Service (S3) Windws Azure Blb Strage Rackspace Clud Files (US and UK) HP Public Clud Any Openstack 4 based Clud Strage (v1 series) Ggle Drive Drpbx Micrsft OneDrive Prviders Gmail (Ggle Apps and Gmail) Yah! Mail Mst IMAP based prviders Database platfrms Micrsft Sharepint 2010, Micrsft SQL Server F-Respnse Cnnectr (CE and abve) Clud Prviders (All included in TACTICAL Versin plus) Micrsft Office 365 OneDrive fr Business Micrsft Office 365 Sharepint Bx.cm Prviders (All included in TACTICAL Versin plus) Micrsft Office 365 Exchange 4 Mre infrmatin n Openstack is available at 7

8 Prerequisites In rder t use F-Respnse yu will require the fllwing: 1. A valid F-Respnse License key FOB ( F-Respnse FOB ) which can be purchased frm the F-Respnse Web site 2. A cpy f the latest F-Respnse Installatin Package fr the versin selected: 1. F-Respnse Enterprise Editin 2. F-Respnse Cnsultant + Cvert Editin 3. F-Respnse Cnsultant Editin 4. F-Respnse Field Kit Editin 3. Micrsft iscsi initiatr sftware, included by default with Windws Vista and abve and freely available fr dwnlad frm the Micrsft web site. Nte: The Micrsft iscsi Sftware Initiatr is available as a free dwnlad frm fr the fllwing perating systems: Micrsft Windws Server 2003 Micrsft Windws XP This versin shuld nt be installed n the fllwing perating systems: Windws Vista Windws Server 2008 Windws 7+ The Micrsft iscsi Sftware initiatr is integrated int Windws Vista, Windws Server 2008, and Windws 7; therefre there is n need t install this package n thse perating system versins. The Micrsft iscsi Sftware initiatr cnfiguratin utility n Windws Vista and Windws Server 2008 can be accessed frm the cntrl panel in classic mde r frm administrative tls in Windws Server (Surce: Micrsft iscsi Sftware Initiatr 2.x User Guide, Nv 2007) 8

9 The diagram belw shws a high level architecture fr F-Respnse. The F-Respnse FOB is lcated at the analysis machine (Cnsultant/Enterprise), and the F-Respnse Target cde may be running n any number f crprate netwrked cmputers. F-Respnse Enterprise High Level Architecture F-Respnse License FOB In rder t use the F-Respnse applicatin yu must have a valid F-Respnse License key FOB ( F-Respnse FOB ), such as the ne shwn belw: This key must be inserted int the USB prt f the cmputer running the F-Respnse License Manager Server, the examiner s analysis machine in the case f Enterprise/Cnsultant Editins, r the target machine if using the Field Kit Editin. Since the F-Respnse FOB uses the USB Human Interface Device drivers it shuld be immediately recgnized by all supprted versins f Micrsft Windws, as shwn belw. 9

10 Operating System respnse t insertin f the F-Respnse FOB Once the F-Respnse FOB has been inserted and recgnized by yur analysis machine, yu are ready t start the Enterprise Editin f F-Respnse n the remte wrkstatin and establish an F-Respnse netwrk cnnectin such that yu may begin analysis using yur tl(s) f chice. 10

11 Getting started with F-Respnse Enterprise Editin If yu pssess a license fr F-Respnse Enterprise Editin, then yu may use yur F- Respnse FOB with any f the F-Respnse Target cde fferings, including the Enterprise Editin ( EE ) Target Cde, Cnsultant + Cvert Editin ( CE+C ) Target Cde, Cnsultant Editin ( CE ) Target cde, r the Field Kit ( FK ) Target cde at yur discretin. Please refer t the respective user manual sectins fr instructins n using F-Respnse in the desired mde. The Enterprise Editin Installatin package installs the fllwing sftware: F-Respnse License Manager and License Manager Mnitr F-Respnse Enterprise Management Cnsle (FEMC) F-Respnse Cnnectr (FC) F-Respnse Acceleratr (FAR) F-Respnse Enterprise COM Object (FEMCCTRL) F-Respnse Enterprise Target Cde (All Supprted Platfrms) F-Respnse Cnsultant Target Cde (All Supprted Platfrms) F-Respnse Dngle Updater The default installatin is t Prgram Files -> F-Respnse. D nt install this installatin package n the machine t be analyzed. 11

12 Cnsultant + Cvert Editin If yu pssess a license fr F-Respnse Cnsultant + Cver Editin, then yu may use yur F-Respnse FOB with any f the F-Respnse Target cde fferings, including the Enterprise Editin ( EE ) Target Cde, Cnsultant Editin ( CE ) Target cde, r the Field Kit ( FK ) Target cde at yur discretin. Please refer t the respective user manual sectins fr instructins n using F-Respnse in the desired mde. The Cnsultant + Cvert Editin Installatin package installs the fllwing sftware: F-Respnse License Manager and License Manager Mnitr F-Respnse Cnsultant + Cvert Cnsle (FCC+) F-Respnse Clud Cnnectr (FC) F-Respnse Cnsultant Cnnectr (FCC) F-Respnse Acceleratr (FAR) F-Respnse Cnsultant COM Object (FCCCTRL) F-Respnse Enterprise Target Cde (All Supprted Platfrms) F-Respnse Cnsultant Target Cde (All Supprted Platfrms) F-Respnse Dngle Updater The default installatin is t Prgram Files -> F-Respnse. D nt install this installatin package n the machine t be analyzed. 12

13 Cnsultant Editin If yu pssess a license fr F-Respnse Cnsultant (r Enterprise) Editin, then yu may use yur F-Respnse FOB with either the Field Kit ( FK ) Target cde r Cnsultant Editin ( CE ) Target cde at yur discretin. Please refer t the Field Kit Editin sectin f the User Manual fr instructins n using F-Respnse in Field Kit mde. The Cnsultant Editin Installatin package installs the fllwing sftware: F-Respnse License Manager and License Manager Mnitr F-Respnse Cnsultant Cnnectr (FCC) F-Respnse Cnnectr (FC) F-Respnse Acceleratr (FAR) F-Respnse Cnsultant COM Object (FCCCTRL) F-Respnse Cnsultant Target Cde (All Supprted Platfrms) F-Respnse Dngle Updater The default installatin is t Prgram Files -> F-Respnse. D nt install this installatin package n the machine t be analyzed. Only the F-Respnse Cnsultant Editin Target Cde is executed n the machine t be analyzed, and this executable is placed in Prgram Files -> F-Respnse -> F-Respnse Cnsultant Editin upn cmpletin f the package installatin. 13

14 Field Kit Editin F-Respnse Field Kit Editin Target cde is a stand alne executable ( exe ). The Field Kit Editin Installatin package installs this sftware ( F-Respnse Field Kit Editin Target cde ), a cpy f F-Respnse Field Kit Editin Target Cde which can be cpied t any number f cmputers t be analyzed. The Field Kit Editin Installatin package installs the fllwing sftware: F-Respnse Field Kit Target Cde (All Supprted Platfrms) F-Respnse Dngle Updater The default installatin is t Prgram Files -> F-Respnse. D nt install this installatin package n the machine t be analyzed. Only the F-Respnse Field Kit Editin Target Cde is executed n the machine t be analyzed, and this executable is placed in Prgram Files -> F-Respnse -> F-Respnse Field Kit Editin upn cmpletin f the package installatin. 14

15 Licensing F-Respnse Using the F-Respnse License Manager Sftware (CE and EE Only) In rder t validate yur license (F-Respnse FOB) frm remte cmputers running F- Respnse Enterprise r Cnsultant Editin target cde, yu must have yur FOB physically cnnected t yur analysis machine and the F-Respnse License Manager must be started. Execute the F-Respnse License Manager Mnitr. Start Menu Flder Cntents The first time the F-Respnse License Manager Mnitr (F-Respnse LM) sftware is executed it will display a System Tray icn indicating the License Manager server is nt installed. System Tray Icn indicating the F-Respnse LM server is nt installed F-Respnse License Manager Mnitr cnsle, Main Windw 15

16 The representatin abve shws a running F-Respnse License Manager Mnitr. Details f the infrmatin in the Netwrk tab fields are as fllws: License Manager Cnfiguratin Operatin IP Address: Lcal machine IP address currently listening fr incming F- Respnse Enterprise/Cnsultant Editin License Validatin requests. TCP Prt: Install Start Stp Lcal machine TCP prt currently listening fr incming F-Respnse Enterprise/Cnsultant Editin License Validatin requests. Installs the License Manager Service executable. Starts the License Manager Server. Stps the License Manager Server. Uninstall Uninstalls the License Manager Service executable. 16

17 Installing and starting the F-Respnse License Manager Befre yu can begin using F-Respnse Enterprise and Cnsultant Editin yu must install and start the F-Respnse License Manager service. Duble click n the F-Respnse License Manager Mnitr icn in the System Tray t bring up the License Manager cnsle. F-Respnse License Manager Mnitr cnsle, Main Windw Install the F-Respnse License Manager service by pressing the Install buttn. After the service is installed it will allw yu t change the bund IP Address and TCP Prt, the service will install in the stpped psitin. F-Respnse License Manager Mnitr, Stpped Psitin 17

18 Start the F-Respnse License Manager service by pressing the Start buttn. Yur F- Respnse FOB must be inserted prir t starting the License Manager server. F-Respnse License Manager running and waiting fr licensing requests. The F-Respnse License Manager is nw running and waiting fr licensing requests. The License Manager autmatically creates Windws Firewall exceptins fr the service applicatin, hwever if yu are using ther firewall prducts yu many need t add exceptins as necessary. 18

19 F-Respnse Cnnectr (Clud Strage Using the F-Respnse Cnnectr fr Clud Strage Targets (TAC, CE, CE+C, and EE) Disclaimer: The F-Respnse Cnnectr and legacy Cnnectr prducts (F-Respnse Cnnectr, Clud Cnnectr, and Database Object Cnnectr) prvide access t 3rd party data surces via Applicatin Prgramming Interfaces (APIs) and internal structures presented by the prvider. 3rd party prvided data surces are by their very nature vlatile. The afre mentined F-Respnse prducts prvide "best effrt" fr accessing and interacting with thse 3rd party data surces hwever service disruptins, API changes, prvider errrs, netwrk errrs, as well as ther cmmunicatins issues may result in errrs r incmplete data access. F-Respnse always recmmends secndary validatin f any 3rd party data cllectin. F-Respnse TACTICAL, Cnsultant, Cnsultant + Cvert, and Enterprise editin includes a cpy f the F-Respnse Cnnectr (FC). The FC allws an examiner t munt remte Clud Strage cntainers, Accunts, and Sharepint Dcuments (Embedded Database Objects) as lcal read-nly lgical vlumes r netwrk shares. The FC des nt require executables r agents be deplyed t remte systems. The FC des require a lcally attached F-Respnse licensed dngle (TACTICAL, Cnsultant, r Cnsultant+Cvert), r a remte Enterprise F-Respnse dngle cnnected via the F- Respnse License Manager at all times. F-Respnse Cnnectr 19

20 Cnfiguring Clud Strage Optins There are a number f ptins that can be cnfigured when using the F-Respnse Cnnectr t access Clud Strage, these ptins include: F-Respnse Cnnectr Cnfigure Clud Strage Optins General Optins Recrd Lg Drpbx Optins Will create a secndary CSV lg file with the drive cntents fr each attached Clud Strage device. Fr Mdified Time Use: Drpbx prvides tw different times that can be used as Mdified Time fr a given file. By default the Clud Cnnectr uses the Mdified time as prvided by the Drpbx Servers. Alternatively it is nw pssible t use the Client MTime, a nn verified time that is assigned t the files when they are mdified by a Drpbx Client tl. The Client MTime is nt verified by Drpbx. D nt shw file revisins (default is t shw all file revisins) By default the cnnectr will shw all revisins fr Drpbx items, checking this bx will tell the Cnnectr t nt request multiple versins f items. Merge all flder paths t lwercase In sme accunts user data is duplicated due t case differences, this will frce all case t lwercase and reduce duplicatin. 20

21 Cnfiguring Clud Strage Credentials Befre yu can cnnect t Clud Strage services yu must first input valid credentials. While the credentials necessary vary by clud strage prvider, all credentials must be input using ne f the Cnfigure Credentials dialg bxes. Credentials->Clud Strage As the credential lcatin and prcess fr acquiring thse credentials changes frequently fr almst all clud prviders, including each ne in this manual wuld quickly becme bslete. Please refer t the specific Missin Guide n the F-Respnse Website fr details n clud prvider yu are attempting t access. F-Respnse Missin Guides are available at 21

22 Scanning fr Clud Strage Targets Use the Scan menu t enumerate clud strage cntainers/buckets by service. F-Respnse Cnnectr Scan Clud Strage menu F-Respnse Cnnectr scan results 22

23 Cnnecting t Clud Strage Targets Yu can cnnect t ne r mre strage targets by simply duble clicking n target. The newly attached vlume will be assigned a drive letter and is nw accessible via Windws Explrer. Lgged in Clud Strage target assigned the G:\ drive letter 23

24 Discnnecting frm Clud Strage Targets Yu can discnnect frm ne r mre strage targets by simply duble clicking n target. Warning befre detaching a cnnected share 24

25 F-Respnse Cnnectr (Database Objects) Using the F-Respnse Cnnectr fr Database Objects, Sharepint 2010(TAC, CE, CE+C, and EE) F-Respnse TACTICAL, Cnsultant, Cnsultant + Cvert, and Enterprise editin includes a cpy f the F-Respnse Cnnectr (FC). The FC allws an examiner t munt remte Micrsft SQL Server Database Objects (Embedded Files, BLOBS, etc) as lcal read-nly lgical vlumes r netwrk shares. The F-Respnse Cnnectr supprts Micrsft Sharepint 2010 nly at present. The FC des nt require executables r agents be deplyed t the remte Micrsft SQL Server(s). The FC des require a lcally attached F-Respnse licensed dngle (TACTICAL, Cnsultant, r Cnsultant+Cvert), r a remte Enterprise F-Respnse dngle cnnected via the F- Respnse License Manager at all times. F-Respnse Cnnectr 25

26 Cnfiguring Database Server Credentials Befre yu can cnnect t Database Server yu must first input valid credentials. The current versin f the FC supprts Micrsft SQL Server 2010 nly, hwever future versins will allw yu t cnnect t ther SQL based servers (including Oracle, etc). The Database Credentials dialg will allw yu t enter ne r mre Database credentials, either Database Native Credentials (SQL Native) r Windws Dmain Credentials. Database Credentials are nt saved between executins f the FC. Credentials->Database Database Credential dialg, Credentials can be either native credentials (Micrsft SQL Server Native Accunts) r Windws Credentials 26

27 Scanning fr Database Object Targets Use the Scan menu t enumerate Micrsft SQL Servers and Databases. The scanning prcess will use the lcal plugins.xml file t test database frmat and table structure. Peridically new plugins.xml files will be placed n the F-Respnse Website t add supprt fr new Database frmats and mdels. Database Object Cnnectr Scan menu F-Respnse Cnnectr scan results Databases nt recgnized are listed n the Messages Panel 27

28 Cnnecting t Database Object Targets Yu can cnnect t ne r mre strage targets by simply duble clicking n target. The newly attached vlume will be assigned a drive letter and is nw accessible via Windws Explrer. Lgged in Database Strage target assigned the G:\ drive letter 28

29 Discnnecting frm Database Object Targets Yu can discnnect frm ne r mre strage targets by simply duble clicking n target. Warning befre detaching a cnnected share 29

30 F-Respnse Cnnectr ( ) Using the F-Respnse Cnnectr fr (TAC, CE, CE+C, and EE) F-Respnse TACTICAL, Cnsultant, Enterprise and Cnsultant+Cvert editin includes a cpy f the F-Respnse Cnnectr (FC). The FC allws an examiner t munt select remte mail items as lcal read-nly lgical vlumes r netwrk shares. IMAP -> Individual Messages in.eml frmat, subject t prvider thrttling. Office365 -> Individual Messages, Calendar Items, Cntacts, and Tasks in native frmats, subject t prvider thrttling. Additinal Exchange Distinguished Flders are checked but may nt be available under all accunts. The FC des nt require executables r agents be deplyed t the remte servers. The FC des require a lcally attached F-Respnse licensed dngle (TACTICAL, Cnsultant, r Cnsultant+Cvert), r a remte Enterprise F-Respnse dngle cnnected via the F- Respnse License Manager at all times. F-Respnse Cnnectr 30

31 Cnfiguring Cnnectr Optins There are a number f ptins that can be cnfigured when using the F-Respnse Cnnectr t access accunts, these ptins include: F-Respnse Cnnectr Cnfigure Optins Cache Lcatin IMAP Optins All cntent is cached lcally, use this ptin t specify a lcatin t stre cache files. Max data dwnladed in a 24hr perid (in gigabytes, ex 2) Many prviders restrict the ttal amunt f data that can be dwnladed in a 24hr perid. Fr instance Ggle limits 5 the ttal t 2.5 Gig/24hrs. By setting a limit here yu enfrce a sft thrttle t limit the chances f accunt lckut. By setting this value t zer yu enfrce n limits and allw the data t be dwnladed at the maximum pssible speed. 5 Mre n Ggle Limits can be fund at 31

32 Cnfiguring Credentials Befre yu can cnnect t service yu must first input valid credentials. The FC prvides access t Gmail, Yah! Mail, mst generic IMAP servers, and Office 365 native Exchange Web Services. Credentials can be tested befre they are added using the Test Credential buttn. Once the credential has been validated press the Add buttn t add them t the list f credentials t be used. credentials are nt saved between executins f the FC. Credentials-> Cnfigure Gmail Credentials Dialg 32

33 Scanning fr Accunt Targets Use the Scan menu t enumerate accunts and IMAP Mailbxes. F-Respnse Cnnectr scan results 33

34 Cnnecting t Accunt Targets Yu can cnnect t ne r mre strage targets by simply duble clicking n target. The newly attached vlume will be assigned a drive letter and is nw accessible via Windws Explrer. The FC will begin prcessing the remte and building a lcal cache. This prcess may be stpped at any time duble clicking n the clck icn. Cancelled prcesses are restarted n the next Lgin peratin. The prcessing phase can take a cnsiderable amunt f time depending n the ttal number f messages, size f the messages, available bandwidth, and any thrttling f perfrmance dne by the prvider. A running utput f the message subjects will be shwn in the Status clumn. Once cmplete, the newly attached vlume will be assigned a drive letter and is nw accessible via Windws Explrer. Prcessing in an accunt 34

35 Discnnecting frm Accunt Targets Yu can discnnect frm ne r mre strage targets by simply duble clicking n target. Warning befre detaching a cnnected share 35

36 F-Respnse Enterprise Enterprise Editin Overview f the F-Respnse Enterprise Management Cnsle (FEMC) At the cre f F-Respnse Enterprise Editin is the F-Respnse Enterprise Management Cnsle (FEMC). Belw is a guideline f the features and functins f the FEMC. F-Respnse Enterprise Management Cnsle Menu Optins File Scan Cnfigure: Cnfigure F-Respnse EMC fr deplying and managing Remte F- Respnse Target cde. Clear Messages: Exit: Clears any infrmatin r errr messages currently in the Messages Panel. Clse and exit the F-Respnse EMC. Scan by Dmain 36

37 Opens a dialg fr Windws Dmain/Wrkgrup scanning t detect F-Respnse Enterprise installatins and/r ptential targets. Deplyment Cnnect Scan by IP Address Opens a dialg fr IP Address range scanning t detect F-Respnse Enterprise installatins and/r ptential targets. Direct Cnnect Opens a dialg fr direct cnnect ptins fr directly cnnecting t a remte cmputer via IP address r Netwrk Name t detect F- Respnse Enterprise installatins and/r ptential targets. Custm Scan Opens a dialg fr inputting a cmma delineated listing f either cmputer names r IP addresses (r bth) t scan t detect F- Respnse Enterprise installatins and/r ptential targets. Install/Start F-Respnse Installs and then autmatically starts F-Respnse Enterprise n the selected cmputer(s). Stp/Remve F-Respnse Stps then remves F-Respnse Enterprise frm the selected cmputer(s). Install F-Respnse Installs F-Respnse Enterprise n the selected cmputer(s). Uninstall F-Respnse Uninstalls F-Respnse Enterprise frm the selected cmputer(s). Start F-Respnse Starts F-Respnse Enterprise n the selected cmputer(s). Stp F-Respnse Stps F-Respnse Enterprise n the selected cmputer(s). Issue Discvery Request Issues an iscsi Discvery request against the selected cmputer(s) r Active Client(s). Open F-Respnse Flexdisk Opens the default web brwser t cnnect t the selected cmputer n the Flexdisk cnfigured prt (HTTPS). Discvery F-Respnse Disks 37

38 Active Clients Help Tab Cntrls Opens a dialg prviding iscsi Discvery request capability by IP Address. Lgin t F-Respnse Disk Initiates an iscsi lgin n the selected F-Respnse Enterprise Target. Lgut f F-Respnse Disk Initiates an iscsi lgut n the selected F-Respnse Enterprise Target. Remve F-Respnse Disk Deletes F-Respnse Target entries fr the selected machine frm the Cnnect Tab. Pll Cntinuusly Refresh Abut Enables r Disables the cntinuus plling f the F-Respnse License Manager. If this menu ptin is unchecked the Active Clients panel will nt accurately reflect Active Clients unless the Refresh menu ptin is used. Refreshes the Active Clients panel, nly available if Pll Cntinuusly is unchecked. Presents a splash screen indicating the versin infrmatin f the F- Respnse Enterprise Management Cnsle (FEMC). Deplyment Cnnect Messages Active Clients Displays a listing f the cmputer(s) capable f administratin, as well as their Dmain/Wrkgrup and current status. Displays a listing f the F-Respnse Target(s) after a successful Discvery Request. Displays infrmatinal Messages during peratin, if errrs ccur they will be nted here. 38

39 Queries the F-Respnse License Manager Service t btain active clients fr the F-Respnse LM dngle. This list includes IP Address, Netwrk Name, and Platfrm. 39

40 Enterprise Editin Cnfiguring the FEMC Deplyment Optins Prir t beginning any peratins with F-Respnse Enterprise Management Cnsle yu must cmplete the Deplyment Optins Cnfigure dialg. All infrmatin inputted will be saved and restred n future usages. In many cases yu may nly need t enter this infrmatin nce. Please refer t the guidelines belw fr cnfiguring the FEMC Deplyment Optins. F-Respnse Enterprise Management Cnsle Deplyment Optins Cnfiguratin Panel F-Respnse Cnfiguratin Validatin Cnfiguratin IP Addr: Cnfigures the IP Address f the F-Respnse LM Service. TCP Prt: Cnfigures the TCP Prt f the F-Respnse LM Service. Hst Cnfiguratin 40

41 Encryptin 6 Physical Memry Check t enable AES 256bit Encryptin fr the F-Respnse Disk cnnectin. Check t enable Physical Memry access n the remte F- Respnse Target (Supprts Windws clients nly). Flexdisk Prt / Checkbx TCP Prt Username Passwrd The TCP Prt the remte F-Respnse Enterprise executable shuld listen n fr Flexdisk (HTTPS) requests. The TCP Prt the remte F-Respnse Enterprise executable shuld listen n fr lgin and discvery requests. The Username the remte F-Respnse Enterprise executable shuld use fr lgin and discvery requests. The Passwrd the remte F-Respnse Enterprise executable shuld use fr lgin and discvery requests. F-Respnse Windws Service Install Cnfiguratin: Service Name This is the name the F-Respnse Enterprise service will be installed as n the remte cmputer(s). This name is cmpletely user selectable. Service Descriptin Executable Unix Platfrm Specific Optins (ADVANCED) Descriptin value that will be assigned t the F-Respnse Enterprise service when installed n the remte cmputer(s). This descriptin is cmpletely ptinal. Use the brwse buttn t lcate the F-Respnse Enterprise executable t install (Typically lcated in C:\Prgram Files\F-Respnse\F-Respnse Enterprise Editin\f-respnseent.exe). 6 Only supprted n analyst machines running Micrsft Windws Vista r abve, if nt supprted ptin will be grayed ut. 41

42 Exprt Exprt MSI A platfrm based set f ptins that will be executed n the remte cmputer, any changes made t the ptins are saved. Optinally they can be reset using the Reset Current r Reset All buttns. Fr additinal infrmatin see the F-Respnse Unix Platfrm ptins Appendix. Pre Start Pst Stp This is a shell cmmand that will be run prir t starting F- Respnse n the remte target. This is a shell cmmand that will be run directly after stpping F-Respnse n the remte target. Additinal Targets This ptin will allw yu t specify additinal targets that may nt be detected autmatically. This buttn will pen a file save dialg bx t exprt the cnfiguratin infrmatin. This is useful when yu need t deply F-Respnse Enterprise via alternate means. Fr mre infrmatin n this prcess see Enterprise Editin Using F-Respnse Enterprise Editin fr Windws (Deplyment withut the FEMC). This buttn will pen a file save dialg bx t exprt a MSI installer precnfigured with the apprpriate cnfiguratin and settings. This MSI installer can be used with any deplyment applicatin that supprt MSI based installatins, including Windws Active Directry Grup Plicy. 42

43 Enterprise Editin Cnfiguring the FEMC Credentials After cmpleting the Deplyment Optins Cnfig dialg, the next step is t cnfigure the F-Respnse target(s) lgin credentials via the Credentials Cnfigure dialg. All infrmatin inputted will nt be saved r pre-ppulated fr future usages. Fr bvius reasns credentials are nt stred when the applicatin is exited. The Credentials Cnfigure windw is divided int tw areas t prvide credential infrmatin fr F-Respnse targets: Windws Dmain/Netwrk Credentials and Unix Credentials. Please refer t the guidelines belw fr cnfiguring the FEMC target Credentials. F-Respnse Enterprise Management Cnsle Cnfiguratin Panel Windws Dmain/Netwrk Credentials Use the Add/Remve buttns t add and/r remve bth Dmain and Lcal machine credentials. These credentials will be used t manage the remte F-Respnse Target cmputer, including Install, Start, Stp, and Uninstall peratins. Use Current User Credentials This ptin remves the inputted credentials in favr f using the lcally lgged in user s credentials. 43

44 Unix Credentials: User Accunt Assume Rt Passwrd Prvides ptins fr entering user accunt name and/r type. Allws fr selecting a manner with which t assume rt privileges, further details n Unix Credentials is available in the Appendix E Understanding Unix Credentials. Prvides the ptins fr entering User r Rt passwrds, alng with the ptin fr using an SSH Key file (Putty r OpenSSH). 44

45 Enterprise Editin Scanning The FEMC presents three different scanning menu ptins fr detecting and enumerating ptential F-Respnse Enterprise target cmputers. Scan Netwrk by Dmain (Lcates Windws Machines Only) Scan Netwrk by Dmain Dialg Scan netwrk by dmain presents a dialg shwing the detected Windws Netwrk Dmains and/r Wrkgrups. Select either an individual dmain/wrkgrup, r the Entire Netwrk. Scan Netwrk by IP Range (Lcates Windws and Unix Machines) Scan Netwrk by IP Range Dialg Scan netwrk by IP Range presents a dialg that accepts a start and end IP address (inclusive) fr an IP Range t be scanned. 45

46 Direct Cnnect (Lcates Windws and Unix Machines) Direct Cnnect Dialg Direct Cnnect presents a dialg that accepts a cmputer Netwrk name r IP Address and attempts t cnnect t the cmputer t perfrm any f the fllwing actins: Install, Uninstall, Start, Stp, and Issue Discvery Request. Custm Scan (Lcates Windws and Unix Machines) Custm Scan Dialg 46

47 Custm Scan presents a dialg that accepts a cmma delineated listing f either cmputer names r IP addresses (r bth) t scan t detect F-Respnse Enterprise installatins and/r ptential targets. In additin the Custm Scan dialg will present the last executed scan input n pening. Enterprise Editin Deplying and Managing F-Respnse using the FEMC (All Supprted Platfrms) Fllwing a successful scanning/enumeratin prcess, the F-Respnse Enterprise Management Cnsle can then be used t install, start, stp, and uninstall F-Respnse Enterprise frm accessible cmputers n the netwrk. The fllwing is a step by step prgressin fr using the FEMC t install, start, cnnect t, discnnect frm, stp, and uninstall F-Respnse Enterprise n remte cmputers. Cmpleted Custm Scan peratin, results shw ne accessible cmputer. Please see Appendix H fr the cmplete icn legend defining the different platfrms. 47

48 Installatin f F-Respnse can be perfrmed by right-clicking n a valid target icn. Installatin can als be perfrmed n multiple targets by selecting them in the Deplyment panel. 48

49 Icn badges indicate F-Respnse has been successfully installed n the target cmputer Select individual targets r multiple targets and select Start F-Respnse t start the remte F-Respnse Enterprise service. 49

50 Icn badges indicate F-Respnse has been successfully started n the target cmputer The Active Clients tab will als shw mre infrmatin abut the remte F-Respnse Enterprise targets currently cnnected t yur license dngle, including platfrm, hstname, and IP Address. 50

51 Issue Discvery Request will btain a cmplete listing f the available targets frm the remte F-Respnse Enterprise cmputers. 51

52 The Cnnect Tab displays a listing f the accessible disks, lgical vlumes, and physical memry (if available) fr each F-Respnse Enterprise Target. (Fr mre infrmatin n the naming cnventin used see Appendix G) Select ne r mre F-Respnse Targets frm the Cnnect Tab and use the Cnnect Menu Lgin t F- Respnse Disk t authenticate and lgin t the remte device. 52

53 Once cnnected the Target icn will change t indicate the disk is nw attached t yur cmputer, in additin the lcal mapping infrmatin will be prvided, in the abve instance the Windws disk-0 has been mapped t PhysicalDisk1. T lgff select ne r mre cnnected F-Respnse Targets and select the Cnnect Menu Lgut f F- Respnse Disk ptin. 53

54 After successful lgut the F-Respnse Target Icn will change and the status indicatr becmes Inactive. When cmplete, select individual targets r multiple targets and select Stp F-Respnse t stp the remte F-Respnse Enterprise service. 54

55 Icn badges indicate F-Respnse has been successfully stpped n the target cmputers When cmplete, select individual targets r multiple targets and select Uninstall F-Respnse t uninstall the remte F-Respnse Enterprise service. 55

56 Icns indicate F-Respnse has been successfully uninstalled n the target cmputers 56

57 Enterprise Editin Using F-Respnse Enterprise Editin fr Windws (Deplyment withut the FEMC) Step 1 Step 2 T use the F-Respnse Enterprise Editin, insert a valid F-Respnse FOB key int a USB prt f the cmputer n which yu will be running the F- Respnse License Manager Service, and then execute the F-Respnse LM Server n this cmputer. Start the remte F-Respnse Enterprise Service which has been installed and cnfigured n the Target cmputer (See Appendix A fr details regarding the cmmand line ptins fr installing, uninstalling, and cnfiguring F-Respnse Enterprise n each target machine.) Once an F-Respnse Enterprise Editin target has been successfully validated, the F-Respnse Enterprise Management Cnsle Active Clients Tab will shw the remte client s IP address, Machine name, and Platfrm as shwn belw. Clients listed under the Active Clients tab are available fr F-Respnse cnnectins using the F-Respnse FEMC, Acceleratr, r iscsi Initiatr. F-Respnse Enterprise Management Cnsle Active Clients Tab 57

58 T examine multiple targets, simply start the remte F-Respnse Enterprise Service n each Target. T see the available targets n the remte cmputer select the IP address in the Active Clients panel and use the cntext menu ptin Issue Discvery Request. 58

59 F-Respnse Cnsultant + Cvert Editin Cnsultant + Cvert Editin Overview The Cnsultant + Cvert Editin prvides all the capabilities f the F-Respnse Cnsultant Editin (see the fllwing F-Respnse Cnsultant Editin sectin f this dcument), hwever it additinally prvides a limited cvert deplyment cnsle capable f deplying and starting F-Respnse n a single active target. Please refer t the fllwing sectins t learn mre abut cnfiguring the F-Respnse Cnsultant + Cvert Cnsle: F-Respnse Enterprise Cnfiguring Deplyment Optins F-Respnse Enterprise Cnfiguring Credentials F-Respnse Enterprise Scanning (Direct Cnnect Only) 59

60 F-Respnse Cnsultant Editin Cnsultant Editin Overview f the F-Respnse Cnsultant Cnnectr F-Respnse Cnsultant Cnnectr Menu Optins File Quick Cnfigure : Opens a dialg t cnfigure the TCP Prt, Username, and Passwrd fr use during Discvery Request r Lgin phases. Create Autcnfigure : Opens a dialg fr creatin f an Autcnfigure package fr F- Respnse Cnsultant Editin. Clear Messages: Exit: Clears any infrmatin r errr messages currently in the Messages Panel. Clse and exit the F-Respnse CC cnsle. 60

61 Cnnect Help Tab Cntrls Discvery F-Respnse Disks Opens a dialg prviding iscsi Discvery request capability by IP Address. Lgin t F-Respnse Disk Initiates a iscsi lgin n the selected F-Respnse Cnsultant Target. Lgut f F-Respnse Disk Initiates a iscsi lgut n the selected F-Respnse Cnsultant Target. Remve F-Respnse Disk Deletes all F-Respnse Disks fr the selected target frm the Cnnect Tab. Open F-Respnse Flexdisk Abut Opens the default cnfigured web brwser pre-ppulated t cnnect t the Flexdisk target. Presents a splash screen indicating the versin infrmatin f the F- Respnse Cnsultant Cnnectr Cnsle (FCC). Cnnect Messages Active Clients Displays a listing f the F-Respnse Target(s) after a successful Discvery Request. Displays infrmatinal Messages during peratin, if errrs ccur they will be nted here. Queries the F-Respnse License Manager Service t btain active clients fr the F-Respnse LM dngle. This list includes IP Address, Netwrk Name, and Platfrm. 61

62 Cnsultant Editin Cnfiguring the FCC Cnsle (Quick Cnfigure) The Quick Cnfigure dialg allws yu t quickly cnfigure the prt, username, and passwrd value fr the F-Respnse cnnectin. Hst Cnfiguratin Flexdisk Prt The TCP Prt the remte F-Respnse Cnsultant editin is listening n fr incming Flexdisk (HTTPS) cnnectins. TCP Prt The TCP Prt the remte F-Respnse Cnsultant editin is listening n fr incming F-Respnse cnnectins. Username The Username cnfigured n the remte F-Respnse Cnsultant editin target. Passwrd The Passwrd cnfigured n the remte F-Respnse Cnsultant editin target. 62

63 Cnsultant Editin Cnfiguring the FCC Cnsle (Create AutCnfigure) The Create Autcnfigure dialg allws yu t create an Autcnfigure package which when executed n the remte machine will bring up F-Respnse cmpletely pre-cnfigured and ready t start. F-Respnse Cnfiguratin Validatin Cnfiguratin IP Addr: TCP Prt: Hst Cnfiguratin All IP Addresses Physical Memry Cnfigures the IP Address f the F-Respnse LM Service. Cnfigures the TCP Prt f the F-Respnse LM Service. Check t enable autmatic binding t all IP Addresses. Check t enable Physical Memry access n the remte F- Respnse Target (Supprts Windws clients nly). Flexdisk Prt TCP Prt TCP Prt the remte F-Respnse Cnsultant executable shuld listen n fr Flexdisk (HTTPS) cnnectins. 63

64 Username Passwrd F-Respnse Cnsultant Executable: Executable TCP Prt the remte F-Respnse Cnsultant executable shuld listen n fr lgin and discvery requests. The Username the remte F-Respnse Cnsultant executable shuld use fr lgin and discvery requests. The Passwrd the remte F-Respnse Cnsultant executable shuld use fr lgin and discvery requests. Use the brwse buttn t lcate the F-Respnse Enterprise executable t install (Typically lcated in C:\Prgram Files\F-Respnse\F-Respnse Cnsultant Editin\). Pressing OK pens the file save dialg allwing yu t select a destinatin fr the F- Respnse Cnsultant executable, Memry Driver (if necessary), and the F-Respnse cnfiguratin file. Save the Autcnfigure package t a usb disk r prtable strage device s that it can be taken t the target cmputer fr executin. 64

65 Cnsultant Editin Using F-Respnse Cnsultant Editin fr Windws Step 1 Step 2 T use the F-Respnse Cnsultant Editin, insert a valid F-Respnse FOB key int a USB prt f the cmputer n which yu will be running the F- Respnse License Manager Service, and then execute the F-Respnse License Manager Service n that cmputer. If yu are using the Autcnfigure feature unique t the Cnsultant Editin, jump t Step 7. If yu are nt using the Autcnfigure feature, make the F-Respnse CE Target cde available t the machine t be analyzed (via USB, netwrk share, CD, etc.,) and execute the F-Respnse CE Target cde. The fllwing cnsultant validatin bx will appear. F-Respnse Cnsultant Editin Validatin User Interface (See Appendix A fr field infrmatin detail) Enter the IP address f the cmputer running the F-Respnse License Manager service (in this case ur F-Respnse LM server is listening n prt 5681 at address ), and select validate. The fllwing appears, albeit with the fields empty, if a valid license key is fund: 65

66 F-Respnse User Interface, cnfigured fr use. (See Appendix B fr field infrmatin detail) Step 3 Select an IP Address frm the Hst IP Address drp-dwn arrw t bind the F-Respnse Target cde t a lcal IP address currently in use by the cmputer. In this case we have chsen Alternatively yu can select All IP Addresses t bind t all available IP addresses. Step 4 Select the TCP Prt. In this instance we chse t keep the default [OPTIONAL] Select the Flexdisk Prt. In this instance we chse t keep the default Step 5 Enter in a username and passwrd value. These values will be used later t authenticate the netwrk cnnectin t this cmputer. Step 6 Press the Start buttn t start listening fr incming cnnectins. When the service is started ne temprary file is created if the Physical Memry ptin has been enabled. This file Mnemsyne.sys is the physical memry driver necessary fr prviding access t physical memry. At this time, the F-Respnse Cnsultant Editin client has been successfully validated, and the F-Respnse Cnsultant Cnnectr Active Clients Tab 66

67 shws the remte client s IP address, Machine name, and Platfrm as shwn belw. F-Respnse Cnsultant Cnnectr Active Clients Tab shws F-Respnse Cnsultant Editin remte client r target cmputer. The Cnsultant Editin permits yu t establish multiple cnnectins. T examine multiple targets, simply start the remte F-Respnse Cnsultant Service n each Target and they will each appear in the F-Respnse Cnsultant Cnnectr Active Clients Tab. This cmpletes F-Respnse preparatin fr this sessin. Remember yu will need the fur entries selected in the User Interface frm Step 2 abve in rder t establish the cnnectin t access the cmputer s drives ver the netwrk. Refer t the sectin n using the F-Respnse Cnsultant Cnnectr t cmplete the cnnectin(s) and access the lcal machine s physical drives frm remte. Steps 7 thrugh 10, belw, are applicable nly if yu are using the Autcnfigure feature unique t the Cnsultant Editin. The Autcnfigure feature unique t the F- Respnse Cnsultant Editin allws yu t create a cnfiguratin file prir t running F- Respnse target cde n any number f machines t be analyzed. This can be a valuable time saving feature if numerus machines are t be investigated, r if an assistant is ging t be starting the tl n a remte machine fr the benefit f the examiner. E.g., The examiner can prepare an Autcnfiguratin CD-ROM. When analysis is t be cnducted, the CD is simply placed in the machine t be analyzed and F-Respnse is run and started frm the CD. N further setup is required. Step 7 67

68 Execute the F-Respnse CE Target cde n a suitable machine in rder t create the prtable cnfiguratin files t be used later n the machine(s) t be analyzed. The fllwing cnsultant validatin bx will appear. F-Respnse Cnsultant Editin Validatin User Interface (See Appendix A fr field infrmatin detail) Select Autcnfigure. The fllwing bx will appear. F-Respnse Cnsultant Editin Autmatic Cnfiguratin Optin In the Validatin Parameters sectin, enter the IP address and Prt f the cmputer running the F-Respnse License Manager service (in this case ur F-Respnse LM server is listening n prt 5681 at address ). In the F-Respnse Cnfiguratin sectin, enter the iscsi TCP Prt (in this instance we chse t keep the default 3260 ), [OPTIONAL] enter the Flexdisk TCP Prt (in this instance we chse t keep the default 3261 ), username (ne r mre characters), and passwrd value (a minimum f 12 characters). These values will be used later t authenticate the iscsi/flexdisk netwrk cnnectin t this cmputer. Step 8 68

69 Press the Save buttn t create the autmatic Cnfiguratin files that will be used n any number f machines t be analyzed. Three files are created; frespnse.ini, flexdmgr.dll (if Flexdisk is enabled), and Mnemsyne.sys (if Physical Memry is Enabled). At this time, the F-Respnse Cnsultant Editin Autmatic Cnfiguratin is cmplete. The examiner can prepare an Autcnfiguratin CD-ROM, thumb drive, r ther delivery mechanism using the three files shwn abve; i.e. 1) f- respnse-ce.exe, 2) frespnse.ini, 3) Mnemsyne.sys (if Physical Memry is enabled), 4) flexdmgr.dll (if Flexdisk is enabled). Step 9 When analysis is t be cnducted, these three files are simply placed in/n the machine t be analyzed. Run f-respnse-ce.exe and the fllwing appears if a valid license key is fund: F-Respnse User Interface, cnfigured fr use. (See Appendix B fr field infrmatin detail) All f the fields are pre-ppulated since the cnfiguratin has already been aut cnfigured. In sme cases, the examiner may have an ptin t select a different IP Address frm the Hst IP Address drp-dwn arrw t bind the F-Respnse Target cde t ne f multiple lcal IP addresses in use by the cmputer. In this case we have chsen t use the default Step 10 Press the Start buttn t start listening fr incming cnnectins. 69

70 At this time, the F-Respnse Cnsultant Editin client has been successfully validated, and the F-Respnse Cnsultant Cnnectr Active Clients Tab shws the remte client s IP address, Machine name, and Platfrm as shwn in the fllwing figure: F-Respnse Cnsultant Cnnectr Active Clients Tab shws F-Respnse Cnsultant Editin remte client r target cmputer. Repeat steps 9 & 10 t make additinal machines available fr analysis. Each will appear in the F-Respnse Cnsultant Cnnectr Active Clients Tab. 70

71 Cnsultant Editin Using F-Respnse Cnsultant Editin fr Unix based Targets F-Respnse Cnsultant/Enterprise (<PLATFORM>),(Versin ) Usage: -h This help page. -a </path/t/devices> Path t additinal devices (Cmma separated, ex /dev/md0,/dev/md1) -S <F-RespnseLM IP> IP Address f F-Respnse LM Server -P <F-RespnseLM Prt> TCP Prt f F-Respnse LM Server, ptinal, defaults t u <username> F-Respnse username, must be 8 characters -p <passwrd> F-Respnse passwrd, must be 14 characters -i <iscsi Prt> iscsi Prt, ptinal, defaults t c <path/t/frespnse.ini> Optinal autcnfigure path, if used n ther cmmandline ptins are required -f <Flexdisk Prt> Optinal Flexdisk prt, if nt prvided Flexdisk services will nt be enabled. F-Respnse Cnsultant/Enteprise Editin can either be run directly frm the cmmandline (using the varius arguments indicated abve, r it can be run with the -c <path/t/frespnse.ini> ptin prvided the path pints t a valid frespnse.ini file. See the F-Respnse Cnsultant Cnnectr autcnfigure ptin t generate a valid "frespnse.ini" F-Respnse cmmand line help n analyst machine The F-Respnse Cnsultant Editin target cde fr nn-windws platfrms is installed and available in the C:\Prgram Files\F-Respnse\F-Respnse Cnsultant Editin\ flder. The executable name will indicate which versin is apprpriate fr yur target platfrm. Platfrm Linux (glibc ) Intel/i386 Linux (glibc ) x64 Apple OSX (10.3, 10.4, 10.5, 10.6, 10.7, 10.8) Universal Binary Sun Slaris (8,9,10) SPARC Oracle Slaris/OpenSlaris Intel IBM AIX (5.1,5.2,5.3,6.1) Pwer 5 IBM AIX (5.1,5.2,5.3,6.1) Pwer 6 F-Respnse Target Cde f-respnse-ce-e-lin f-respnse-ce-e-lin-64 f-respnse-ce-e-sx f-respnse-ce-e-sun f-respnse-ce-e-sun-i386 f-respnse-ce-e-aix-p5 f-respnse-ce-e-aix-p6 71

72 HP Unix (11iv2,11iv3) Itanium FreeBSD (7) Intel/i386 FreeBSD (7,8) x64 Intel SCO Unix (Open Server 6, Unixware 7) Intel/i386 Ggle Andrid(ARM) NetGear ReadyNAS (SPARC) f-respnse-ce-e-hpux f-respnse-ce-e-fbsd f-respnse-ce-e-fbsd-64 f-respnse-ce-e-sc f-respnse-ce-e-andrid-arm f-respnse-ce-e-readynas-sparc Example Usage: Scenari #1 The F-Respnse target platfrm is Linux and the F-Respnse License Manager Server is n , Prt 5681 Make the F-Respnse CE Target cde available t the machine t be analyzed (via USB, netwrk share, CD, etc.) Execute the F-Respnse Target cde n the machine as Rt, please see Appendix E Understanding Unix Credentials fr mre infrmatin. At the cmmand line n the target platfrm type:./f-respnse-ce-e-lin S P 5681 u <FRESUSERNAME> p <FRESPASSWORD> i 3260 Scenari #2 Using the F-Respnse Autcnfigure file frespnse.ini created using F- Respnse Cnsultant Cnnectr. The F-Respnse target platfrm is Linux. Make the F-Respnse CE Target cde and the f-respnse.ini created by the Cnsultant Cnnectr available t the machine t be analyzed (via USB, netwrk share, CD, etc.) Execute the F-Respnse Target cde n the machine as Rt, please see Appendix E Understanding Unix Credentials fr mre infrmatin. At the cmmand line n the target platfrm type:./f-respnse-ce-e-lin c frespnse.ini 72

73 Cnsultant Editin Using the F-Respnse Cnsultant Cnnectr The Active Clients Tab in the F-Respnse Cnsultant Cnnectr shws clients actively cnnected t the F- Respnse License Manager. Prir t issuing a Discvery Request r Cnnecting t an F-Respnse Target yu must first input yur username and passwrd infrmatin int either the File->Quick Cnfigure r Create Autcnfigure Dialg, these are the same username and passwrd values entered n the Cnsultant remte target gui. 73

74 Select ne r mre Active Clients and select Cnnect->Issue Discvery Request t perfrm a discvery request against the remte target. Fllwing a successful Discvery Request the Cnnect Tab will cntain a listing f valid Targets (Physical Disks, Lgical Vlumes, and/r Physical Memry). Mre n Target naming in Appendix G. 74

75 Select ne r mre targets and select Cnnect -> Lgin t F-Respnse Disk t authenticate t and access the remte device. Fllwing a successful lgin, the Target icn will indicate cnnected, and the Lcal disk clumn will shw the lcally cnnected disk that maps t the remte device. 75

76 T lgff f the F-Respnse Target, select the cnnected Target and select Cnnect -> Lgut f F- Respnse Disk. Once lgff peratin cmpletes the icn will indicate discnnected and the Lcal Disk clumn will indicate Inactive. 76

77 F-Respnse Acceleratr (Cnsultant, Cnsultant + Cvert, and Enterprise Only) The F-Respnse Acceleratr is a secndary cnnectin utility prvided t Cnsultant and Enterprise license hlders. Essentially the Acceleratr remves the need t navigate the smewhat difficult Micrsft iscsi Initiatr t cnnect t F-Respnse targets frm machines that d nt currently have an F-Respnse license dngle inserted in them. By using the F-Respnse Acceleratr a custmer can create cnnectins frm many F- Respnse Acceleratr machines t many F-Respnse targets. Upn starting the F-Respnse Acceleratr yu will be prmpted t input the IP and Prt f the F-Respnse License Manager in rder t validate yur license and begin using Acceleratr The F-Respnse Acceleratr main windw Start by selecting File->Cnfigure t input yur F-Respnse username, passwrd, and tcp prt 77

78 T lcate F-Respnse Targets and cnnect t them start by using the Cnnect->Find F-Respnse Disks, this will pen a dialg where yu can input the target machine IP addresses. 78

79 Field Kit Editin F-Respnse Field Kit Editin Using F-Respnse Field Kit Editin fr Windws Step 1 T use the F-Respnse Field Kit, insert a valid F-Respnse FOB key int a USB prt f the cmputer t be analyzed. Make the F-Respnse FK Target cde available t the lcal machine (via USB, netwrk share, CD, et al) and execute the F-Respnse FK Target cde. The belw user interface will appear. F-Respnse User Interface, cnfigured fr use. (See Appendix A fr field infrmatin detail) Step 2 Select an IP Address frm the Hst IP Address drp-dwn arrw t bind the F-Respnse Target cde t a lcal IP address currently in use by the cmputer. In this case we have chsen Step 3 Select the TCP Prt, in this instance we chse t keep the default

80 Step 4 Enter in a username and passwrd value. These values will be used later t authenticate the netwrk cnnectin t this cmputer. Step 5 Press the Start buttn t start listening fr incming cnnectins. This cmpletes F-Respnse preparatin fr this machine. Remember yu will need the fur entries selected in the User Interface abve in rder t establish the cnnectin t access this cmputer s drives ver the netwrk. Refer t the next sectin n using the Micrsft iscsi Initiatr t cmplete the cnnectin and access the lcal machine s physical drives frm remte. 80

81 F-Respnse Field Kit Editin Using F-Respnse Field Kit Editin fr Unix (Linux, Apple OS X) mshannn]#./f-respnse-fk-lin -h F-Respnse Field Kit (Linux),(Versin 5.0.0) Usage: -h This help page. -u <username> Username, must be eight(8) characters. -p <passwrd> Passwrd, must be furteen(14) characters. -i <prt> iscsi prt, ptinal, default is a <path/t/device> Assign additinal devices, cmma separated, ex. "-a /dev/md0". Examples: T use F-Respnse Field Kit (Linux Editin): f-respnse-fk-lin -u jsmith01 -p passwrd The F-Respnse Field Kit Editin fr Apple OS X and Linux is installed and available in the C:\Prgram Files\F-Respnse\F-Respnse Field Kit Editin\ flder. The executable name will indicate which versin is apprpriate fr yur target platfrm. F-Respnse Field Kit Editin fr Linux f-respnse-fk-lin F-Respnse Field Kit Editin fr Apple OSX (10.4, 10.5, 10.6 Intel) f-respnse-fk-sx Example Usage: Scenari #1 F-Respnse License Manager Server n , Prt sud./f-respnse-fk-lin u mshannn p mshannn i

82 F-Respnse Field Kit Editin Cnnecting t an F-Respnse Target This is the Micrsft iscsi Initiatr cnsle. First select Change t rename yur initiatr nde. Set this value t whatever value was inputted in the F-Respnse Field Kit user interface username field. Select OK. 82

83 Nw yu must add the Target Prtal. Select the Add buttn n the Discvery tab. Input the IP Address and TCP prt f the remte F-Respnse Field Kit cmputer. These values must match the nes entered in the F-Respnse Field Kit user interface. Once this is cmplete select the Advanced buttn. 83

84 Check the bx fr CHAP lgn infrmatin and enter the Username and Passwrd previusly entered int the F-Respnse Field Kit user interface. Select OK. 84

85 The machine running yur Target cde nw appears in the Target Prtals listing under the Discvery tab. Once this is cmplete prvided all inputs are valid, select the Targets Tab. The Targets tab will shw a valid target fr each physical device n the F-Respnse Field Kit Target cmputer. In the abve instance there are tw valid physical disks n the remte cmputer. In additin, yu will nte the netwrk name f the cmputer, in this case charybdis, which is included in the target name t differentiate multiple targets. Select a target t cnnect t and select Lg On. Nw, select the Advanced buttn. 85

86 Under Advanced Settings, check the CHAP lgn infrmatin check bx and input the Username and Passwrd defined n the F-Respnse Field Kit user interface. Select Ok t cmplete. 86

87 Prvided the Username and Passwrd infrmatin was entered crrectly and any necessary firewall mdificatins have been perfrmed, yu shuld see Status Cnnected. At this pint the remte Physical Disk is cnsidered a lcal Physical Disk n yur analysis wrkstatin. Yu can cnnect t additinal targets if desired using the same prcess. As nted earlier, the remte Physical Disk has been attached by the iscsi Initiatr and perating system, which in this instance is presented as Lcal Disk (H:). This drive is als accessible as a raw Physical Disk using any Cmputer Frensics r ediscvery applicatin. Yu can use Device Manager t verify that the remte devices appear as lcal physical disks. 87

88 F-Respnse Field Kit Editin Discnnecting frm an F-Respnse Target When yu are finished reviewing the disk, clse all pen disk access prgrams (e.g. Flders pen, sftware reviewing the disk, etc). Select the cnnected target frm the iscsi Initiatr cnsle and select Details. Check the bx fr Identifier and select Lg ff. WARNING: If the disk is still in use (i.e. Flders pen, sftware reviewing the disk, etc) Windws will nt release the disk and will prvide the fllwing warning message. Be sure t clse all pen disk access befre selecting Lg ff If the Initiatr still des nt permit the sessin t be lgged ff, yu can frce the sessin t clse by selecting the stubbrn Target under the Discvery tab, and selecting Remve. 88

89 Once successfully lgged ff, the Sessin Identifier shuld be remved. Yu can cntinue wrking adding and deleting sessins, as needed r if yu are finished wrking, yu may nw clse the Micrsft iscsi initiatr and stp F-Respnse Field Kit n the Target cmputer. 89

90 F-Respnse Flexdisk What is a F-Respnse Flexdisk? F-Respnse Flexdisk Web Viewer The F-Respnse Flexdisk (Patented) is a web based disk access and representatin tl. The Flexdisk uses standard web technlgies (HTTPS/REST 7 ) t prvide direct access t the remte target machines Lgical and Physical targets in bth raw and lgical frmat. The Flexdisk can be accessed and used frm any mdern web brwser and als expses a feature rich and extensible applicatin prgramming interface (API) accessible frm any system capable f making and interpreting web queries and JSON 8. Hw d I access and use a F-Respnse Flexdisk? Using the F-Respnse Flexdisk is as easy as wrking with a web brwser. The Flexdisk web viewer interface cntains multiple icns as well as a clearly defined legend t cver their usage and meaning. A sample f that legend appears belw: 7 REST r Representatinal State Transfer is a web services develpment mdel that uses simple HTTP verbs such as GET and POST. 8 JSON r Javascript Object Ntatin is a data frmatting style cnsidered smaller and easier t manipulate when cmpared t XML. 90

91 In additin t using the prvided web viewer, the F-Respnse Flexdisk prvides a rich and capable web services API that can be used t build mbile and web based applicatins that leverage F-Respnse Flexdisk prvided cntent. Mre infrmatin f using the Flexdisk API is available in the Flexdisk API dcument available n the Dwnlads page f the F- Respnse Website. Frequently Asked Questins 1. Q) Can multiple initiatrs cnnect t a single F-Respnse target machine? 2. Q) D I change any data n the target cmputer by using F-Respnse? 3. Q) I am cnnected via F-Respnse. I navigated t a file n the remte cmputer, hit delete, and it appears t be gne. Did I really delete the file? 4. Q) I have a persnal firewall running n my cmputers. D I need t change firewall settings t use F-Respnse? 5. Q) I have a remte user that accidentally deleted a file. Can I use F-Respnse t recver deleted files? 6. Q) Is the F-Respnse iscsi cnnectin encrypted? 7. Q) Des F-Respnse wrk as an agent? 8. Q) Can I deply F-Respnse t Linux r Other Operating Systems (OS s)? 9. Q) When I attempt t deply F-Respnse using the FEMC I cannt, even thugh I have valid credentials? 10. Q) I established an F-Respnse cnnectin, tried t view the remte Dcuments and Settings flder and received a message that I dn t have permissin t view that flder. Why dn t I have access? 11. Q) What prt des the F-Respnse EMC management cnsle use t deply and manage the F-Respnse Service? 12. Q) Where des the F-Respnse EMC management cnsle install r place the F- Respnse Enterprise executable and cnfiguratin file? 13. Q) What prt des the F-Respnse EMC management cnsle use t deply and manage the F-Respnse Service? 1. Q) Can multiple initiatrs cnnect t a single F-Respnse target machine? A) While the F-Respnse target cde is running, any iscsi initiatr with access t the listening prt can cnnect t the machine; prvided, f curse, that the prper authenticatin credentials are prvided. 2. Q) D I change any data n the target cmputer by using F-Respnse? A) Once the F-Respnse Target cde is executed and the netwrk cnnectin is established, the practitiner cnducting the analysis cannt edit r alter data n the machine under inspectin via the F-Respnse cnnectin. Executing r starting 91

92 the F-Respnse service des, f curse, effect sme change t the target cmputer, but the changes are abut as minimal as they can be fr analysis that is being cnducted n a live machine. 3. Q) I am cnnected via F-Respnse. I navigated t a file n the remte cmputer, hit delete, and it appears t be gne. Did I really delete the file? A) N, yu didn t delete the file. Yu cannt delete files, alter Meta data, r effect any ther changes n the machine under inspectin using F-Respnse. What yu did d was fl yur analysis machine int believing that the file is deleted and thus yur analysis machine is n lnger presenting the file t yu as available. 4. Q) I have a persnal firewall running n my cmputers. D I need t change firewall settings t use F-Respnse? A) Pssibly, F-Respnse des create temprary exceptins in the Windws Firewall during executin. Furthermre these exceptins are remved when the applicatin exits. Hwever, if yu are using a firewall ther than the Micrsft Windws Firewall, yu may need t set an exceptin. F-Respnse machines must be able t send and receive n prt 3260 (this default is changeable) and if using the Enterprise r Cnsultant Editin, als prt 5681 (this default is changeable). We recmmend disabling the firewall fr the duratin f the sessin during ad hc usage (e.g. temprary cnsultant use at a third party site), and tuning the firewall cnfiguratins t allw F-Respnse cnnectivity fr planned enterprise deplyment. 5. Q) I have a remte user that accidentally deleted a file. Can I use F-Respnse t recver deleted files? A) F-Respnse will enable yu t use yur recvery tl f chice t recver the file(s) t a lcatin ther than the target machine. Yu cannt restre the file directly t the target machine via F-Respnse because yu d nt have write capability n that machine, but yu can recver the file and make it available t the user via , netwrk share, etc. 6. Q) Is the F-Respnse iscsi cnnectin encrypted? A) By default, n. Hwever AES 256 bit Encryptin is available in F-Respnse Enterprise editin. Alternatively, there are native methds t accmplish this, if needed. E.g. using Micrsft IPSec plicy manager yu can create a cnfiguratin t enfrce an IPSec plicy in yur enterprise gverning prts 3260, r whatever prt yu have elected t use with F-Respnse. This culd be used t frce F- Respnse t be used ver an IPSec tunnel, and thus allw yu t have the F- Respnse service start autmatically with each bt. If F-Respnse is being used ver the Internet and crprate plicy dictates encryptin ver public netwrks, then the existing crprate VPN capability shuld satisfy the encryptin plicy. 92

93 7. Q) Des F-Respnse wrk as an agent? A) N. It des nt cllect r stre any data n the machine under inspectin. It des nt reprt t a management server. It des nt have an inherent analysis r reprting capability. 8. Q) Can I deply F-Respnse t Linux r Other Operating Systems (OS s)? A) Yes, we have supprt fr 7+ Nn Windws Operating systems. See the platfrms supprted sectin f this dcument fr further details. 9. Q) When I attempt t deply F-Respnse using the FEMC I cannt, even thugh I have valid credentials? A) Yur target machine is mst likely a Windws XP machine nt running in Classic mde fr credential authenticatin. This is typically the case when attempting t cnnect t XP machines nt part f a Windws Dmain. T switch the target machine t Classic yu must pen the Lcal Security Plicy Administratin Tl under Cntrl Panel, Administrative Tls. Yu will then select Lcal Plicies->Security Optins and change the value f Netwrk Access: Sharing and Security Mdel fr Lcal Accunts t Classic Lcal Users authenticate as themselves. This is nly necessary in when using the FEMC t deply F-Respnse t XP r greater cmputers nt part f a Windws Dmain. If the target machine is a Windws 7, Vista, r newer Windws OS and nt jined t a Dmain (ie. Wrkgrup Member) then a key will need t be added t the registry f the target machine. Yu can manually create and add this key t the registry by fllwing these steps: T create yur registry key, cpy the fllwing infrmatin int Ntepad: [HKEY_LOCAL_MACHINE\SOFTWARE\Micrsft\Windws\CurrentVersin\Plicies\Syst em] LcalAccuntTkenFilterPlicy =dwrd:

94 Save this file as LcalAccuntTkenFilterPlicy.reg, and then cpy it t yur target machine. Duble click this file n the target machine t ppulate the registry with this key. T remve fllw the same steps as abve this time with the fllwing infrmatin: [HKEY_LOCAL_MACHINE\SOFTWARE\Micrsft\Windws\CurrentVersin\Plicies\Syst em] LcalAccuntTkenFilterPlicy =dwrd: Q) I established an F-Respnse cnnectin, tried t view the remte Dcuments and Settings flder and received a message that I dn t have permissin t view that flder. Why dn t I have access? A) Yu have the access with the right tls. Yu prbably used Windws Explrer r an equivalent tl that is subject t the file permissin settings fr thse flders. If yu use a frensics tl that can take advantage f yur raw drive access, then yu wn t have this issue. 11. Q) What prt des the F-Respnse EMC management cnsle use t deply and manage the F-Respnse Service? A) The F-Respnse EMC uses Micrsft File and Printer Sharing services fr remte administratin and deplyment, TCP Prt Q) Where des the F-Respnse EMC management cnsle install r place the F- Respnse Enterprise executable and cnfiguratin file? A) The F-Respnse EMC places the executable and cnfiguratin file in the C:\Windws WINNT\System32 SysWw64 flder depending n Windws versin. 13. Q) What prt des the F-Respnse EMC management cnsle use t deply and manage the F-Respnse Service? A) The F-Respnse EMC uses Micrsft File and Printer Sharing services fr remte administratin and deplyment, TCP Prt

95 Supprt Didn t find what yu re lking fr in the manual? Many f ur custmers find that ur grwing selectin f brief tutrial vides ffers the infrmatin t meet their immediate needs: We take pride in prviding prmpt attentin t yur supprt needs, and will supprt yur F-Respnse prduct fr the perid f yur license term. F-Respnse supprt can be reached via supprt@f-respnse.cm Website (Chat Supprt): Sftware and dcumentatin updates will be made available fr dwnlad t registered users n the F-Respnse web site. supprt is available t licensed sftware users. We typically respnd t yur queries within 1 business day f receiving yur request. 95

96 Linux License Manager and Acceleratr F-Respnse Cnsultant and abve nw includes an F-Respnse License Manager and Acceleratr fr 32 and 64 bit Linux platfrms. The License Manager and Acceleratr, alng with a sample init script fr starting the License Manager autmatically is included in the installatin flder in the directry Linux Tls. f-respnse-accel-lin (F-Respnse Acceleratr fr Linux, 32bit nly) The F-Respnse Acceleratr fr Linux essentially uses the Linux iscsi Initiatr t assist with cnnecting t F-Respnse Targets. f-respnse-lm-lin(lin64) (F-Respnse License Manager fr Linux, 32 and 64 bit) The F-Respnse License Manager fr Linux prvides F-Respnse License Manager services frm the Linux platfrm (32 and 64 bit). It currently des NOT prvide the encryptin services that are available frm the Windws versin f the License Manager, if that is a requirement in yur envirnment yu will have t cntinue t use the Windws License Manager. Use the d ptin plus a & t run the License Manager Service. Running the cmmand withut any ptins will return a list f the active clients. 96

97 frespnselm (Init Script Sample) In additin t the abve binaries, yu will als find a sample init (initializatin script) that culd be used t cnfigure the License Manager t run at bt. Please refer t the specific Linux server and distributin fr mre details n setting up init scripts, etc. 97

98 Missin Guides What are Missin Guides? F-Respnse Missin Guides were designed t simplify the prcess f using F-Respnse sftware in new and unfamiliar scenaris. Missin guides ffer a pssible slutin t yur task, wrking with yu each step f the way thrugh instructin that is direct and t the pint. Much smaller than a manual, Missin Guides give yu the exact infrmatin yu need t get yu cnnected and underway as fast as pssible. Missin Guides are simple, straight frward, 4-6 page PDF dcuments that cver all the steps necessary t accmplish a specific "Missin" with F-Respnse. All Missin Guides are available at under the Supprt link at the tp f every page. A selectin f the Missin Guides available at the time this dcument was develped is available belw: F-Respnse Enterprise Editin Cnnect t a remte Linux target(s) disk using F-Respnse Enterprise Editin Cnnect t a remte Apple target(s) disk using F-Respnse Enterprise Editin Cnnect t a remte Windws target(s) disk using F-Respnse Enterprise Editin Cnnect t the F-Respnse Bt CDROM using F-Respnse Enterprise Editin F-Respnse Cnsultant Editin Cnnect t a remte Linux target(s) disk using F-Respnse Cnsultant Editin Cnnect t a remte Apple target(s) disk using F-Respnse Cnsultant Editin Cnnect t a remte Windws target(s) disk using F-Respnse Cnsultant Editin Cnnect t the F-Respnse Bt CDROM using F-Respnse Cnsultant Editin F-Respnse Field Kit Editin Cnnect t the F-Respnse Bt CDROM using F-Respnse Field Kit Editin F-Respnse TACTICAL Cnnect t the F-Respnse Bt CDROM using F-Respnse TACTICAL 98

99 Sftware Revisin Histry The fllwing list identifies changes made t the F-Respnse sftware: F-Respnse cntains the fllwing new features and enhancements: Changes affecting Enterprise, Cnsultant + Cvert, Cnsultant Editin, and TACTICAL - Updates and enhancements t the F-Respnse Cnnectr, including: New ptin t set max retry attempt fr OAuth based clud service prviders. New ptin fr Drpbx t reset all cntent t lwercase, necessary t reduce data duplicatin in accunts that are accessed bth via Apple and Windws. Additin errr handling fr nn-standard and timeut respnses frm prviders. Mdificatins t the encding and decding f Gmail prvided messages. Updates t Amazn S3 necessary t handle nn-us buckets. - Updates t the Apple OSX F-Respnse executable t reduce ptential fr sleep r hibernatin while actively cnnected t. - Deplyment mdificatins fr Apple OSX El Capitan t handle changes in security. F-Respnse cntains the fllwing new features and enhancements: Changes affecting Enterprise, Cnsultant + Cvert, Cnsultant Editin, and TACTICAL - Additinal supprted remte clud strage envirnments fr CE and abve users added: Bx.cm - Supprt fr munting ffline cache files created by the F-Respnse Cnnectr when accessing accunts. - Cmplete redesign f the Gmail ptin fr the F-Respnse Cnnectr. Newly revised Gmail uses OAuth based web service specifically prvided by Ggle fr accunt archiving and backup. This replaces previus IMAP Gmail ptin. F-Respnse cntains the fllwing new features and enhancements: Changes affecting Enterprise, Cnsultant + Cvert, Cnsultant Editin, and TACTICAL - Cmpletely redesigned F-Respnse Cnnectr taking the place f the prir Clud/ /Database cnnectrs. Additinal supprted remte clud strage envirnments fr CE and abve users added, including Office 365 OneDrive fr Business Office 365 Sharepint Numerus bug fixes and prduct architecture changes t increase stability and perfrmance. Additinal lgging ptins fr individual prviders. Optinal revisin histry access fr Drpbx. Included installatin f driver fr TACTICAL hsted F-Respnse Cnnectr. Changes affecting all versins - Updates t F-Respnse Windws Subject executables t handle GPT Partitins and disks n remte Windws machines (addressed incnsistencies in detecting certain partitins in ). Changes affecting Enterprise, Cnsultant + Cvert, and Cnsultant Editin 99

100 - Updates t F-Respnse Slaris Subject executable t handle select drive recgnitin issues. Change affecting Enterprise Editin - Updates t the FEMC COM Library fr x64 systems t prperly detect Apple OSX remte targets. F-Respnse cntains the fllwing new features and enhancements: Changes affecting Enterprise, Cnsultant + Cvert, Cnsultant Editin, and TACTICAL - Additin f a Linux F-Respnse Acceleratr and F-Respnse License Manager(x86 and x64). - Update t the F-Respnse Clud Cnnectr, including: Updates and enhancements t better address case sensitivity in clud presented vlumes. Change includes adding unique identifiers t presented file names n all supprted Clud envirnments. Updates t Rackspace cntainer detectin, nw detects cntainers utside f the hme cntainer regin. - Updates t the F-Respnse Cnnectr, including: Updates t imprve handling f nn-standard separatr characters in IMAP mailstres. Numerus imprvements fr Office365 including: Enhanced speed and stability. Detectin f MeetingRequestRespnse entries. - Updates t the F-Respnse Database Object Cnnectr, including: Updates t handle OLEDB cnnectivity and stability issues present n certain wrkstatin cnfiguratins. Changes affecting all versins f F-Respnse - Update t the F-Respnse Physical Memry Driver fr imprved stability. F-Respnse cntains the fllwing new features and enhancements: Changes affecting Enterprise, Cnsultant + Cvert, Cnsultant Editin, and TACTICAL - Update t the F-Respnse Clud Cnnectr, including: Additin f CSV style lg utput fr cnnected drive/device cntent. Additin f ptins fr alternate Mdified Time values in Drpbx. Mdificatins t handle API changes and encdings fr: Drpbx Ggle Drive Updates t include Drpbx revisin histry items. - Updates t the F-Respnse Cnnectr, including: Additinal ptins n the Cnfigure Optins dialg t allw fr mre user directed decisins regarding thrttling. Mdificatins t better handle UTF-8 and UTF-16 character encdings in flder names and paths. Adjustments t the thrttling detectin heuristics. Optin t attach individual flders r the entire accunt. - Updates t the F-Respnse Database Object Cnnectr, including: Updates t the SQL Server scanning dialg t imprve handling f mre cmplex cnnectin strings. 100

101 Additinal errr reprting fr database errr respnses. - Updates t the Linux (32 and 64bit) F-Respnse executable t imprve device detectin. F-Respnse cntains the fllwing new features and enhancements: Changes affecting Enterprise, Cnsultant + Cvert, Cnsultant Editin, and TACTICAL - Update t the F-Respnse Clud Cnnectr, including: Drpbx Updates t crrect Mdified Metadata, prir release mnth values were ff by ne, ie (February wuld be identified as January, etc). - Updates t the F-Respnse Enterprise Management Cnsle t detect remte machines with nn-standard rt Windws System path. - Updates t the F-Respnse HP_UX 11i executable t include detectin f lgical vlumes. - Updates t the F-Respnse Flexdisk Technlgy (Linux, Windws, and OSX) JSON utput nw cntains additinal entries fr alternate data streams with NTFS JSON utput includes higher reslutin time values in additin t Unix timestamp values where pssible. F-Respnse cntains the fllwing new features and enhancements: Changes affecting Enterprise, Cnsultant + Cvert, and Cnsultant Editin - Update t the F-Respnse Clud Cnnectr, including imprved handling f nn-printable characters, and supprt fr the fllwing newly added Clud Strage envirnments: Ggle Drive Includes Ggle Drive and Ggle Apps fr Business Drive access. Drpbx Micrsft Skydrive - Updates t the F-Respnse Cnnectr, including imprved handling f IMAP thrttling, newly added supprt fr Office 365 using native Micrsft Exchange Web Services, a new cnfigure ptins dialg fr selectable ptins, and supprt fr accessing Gmail Calendar exprts. - Updates t the Database Cnnectr including imprved handling f ptentially crrupt Sharepint instance data. - Additinal errr details fr all Cnnectr Suite prducts, as well as additinal errr details fr nn-standard iscsi interactins. - Crrectins t the F-Respnse COM Objects t handle Active Clients lgic. - Updates t the F-Respnse COM Object Script samples. - Updated versin f the F-Respnse executable fr HPUX, crrected ptential incrrect drive size reprt. Changes affecting the Enterprise and Cnsultant + Cvert versin f F-Respnse - Updates t the F-Respnse Enterprise Management Cnsle r Cvert Cnsle t better handle unix systems with nn-standard shell interactin. This net result shuld be imprved deplyment capability fr nn-windws systems. F-Respnse cntains the fllwing new features and enhancements: Changes affecting Enterprise, Cnsultant + Cvert, and Cnsultant Editin 101

102 - New F-Respnse Database Object Cnnectr, prviding access t embedded file database bjects. Supprts Micrsft Sharepint Databases n Micrsft SQL Server. - New F-Respnse Cnnectr, prviding access t remte IMAP as a lcal read-nly vlume. Includes supprt fr Gmail, Yah! Mail, and any generic IMAP based (SSL r Nn-SSL) server. - Windws 8 Supprt fr all F-Respnse Cnnectr series prducts. - F-Respnse License Update check nw ccurs silently when dngle is within ten days f expiratin. - Crrected the License Manager Mnitr t better handle rare timeut issues when starting the License Manager Service. Changes affecting the Cnsultant versin f F-Respnse - General usability updates fr the F-Respnse Cnsultant Cnnectr, cntext menu crrectins, etc. Changes affecting all versins f F-Respnse - Updates t all versins f F-Respnse t better supprt target machines with a large number f disk devices. F-Respnse cntains the fllwing new features and enhancements: Changes affecting Enterprise and Cnsultant + Cvert Editin - F-Respnse Clud Cnnectr has been updated t use a new caching mdel which greatly imprves speed and perfrmance. - F-Respnse Enterprise COM Object has been imprved t better detect and deply t newer versins f Linux, including recent Ubuntu releases (12.04, 12.10). - F-Respnse FreeBSD executable nw included fr 64bit FreeBSD n Intel. - Minr perfrmance updates t the F-Respnse Enterprise Management Cnsle and Cvert Cnsle t imprve speed and platfrm supprt. - F-Respnse Enterprise Management Cnsle and Cvert Cnsle nw able better able t detect and deply t legacy Windws cmputers. - F-Respnse Enterprise COM Object fr x64 Windws is nw included with the standard installatin (n x64 examiner machines). - F-Respnse Enterprise Management Cnsle, Cver Cnsle, and F-Respnse Acceleratr nw remve legacy iscsi target prtals n lgut t reduce cnfusin. - F-Respnse Enterprise Management Cnsle and Cvert Cnsle nw able t assign a Service Descriptin t the F-Respnse Enterprise Service [Optinal]. - Direct Cnnect ptin in the bth management cnsles has been multi-threaded, resulting in a faster and mre rbust user experience. - F-Respnse Clud Cnnectr (Enterprise versin nly) n lnger requires lcal dngle, supprt license manager peratin (similar t Acceleratr). Changes affecting Cnsultant Editin - F-Respnse Cnsultant Cnnectr nw remves legacy iscsi target prtals n lgut t reduce cnfusin. - F-Respnse Cnsultant COM bject fr x64 Windws nw included in the standard installatin (n x64 examiner machines). - F-Respnse FreeBSD executable nw included fr 64bit FreeBSD n Intel. 102

103 Changes affecting all versins f F-Respnse - New F-Respnse Dngle Updater has been added t Enterprise, Cnsultant+Cvert, Cnsultant, and Field Kit. This new updater uses a new upt2 file frmat and remves the requirement t dwnlad a separate dngle updater frm the F-Respnse website when renewing r upgrading yur license. - Windws 8 Supprt fr all F-Respnse Examiner prducts (FEMC, FCC, etc) has been added. - F-Respnse target executable fr Windws nw better able t handle physical memry n Windws 2000 systems. F-Respnse cntains the fllwing new features and enhancements: Changes affecting Enterprise Editin and Cnsultant + Cvert Editin - F-Respnse Clud Cnnectr nw supprts Windws Azure Blb Strage. Changes affecting all versins f F-Respnse - Imprved handling f nn-standard munt pints in Linux. - Imprved Physical Memry access stability based n further input frm the Vlatility Prject. F-Respnse cntains the fllwing new features and enhancements: Changes affecting Enterprise and Cnsultant + Cvert Editin - New F-Respnse Clud Cnnectr prviding direct read-nly access t Clud Strage Envirnments, including Amazn S3, Rackspace Clud Files, HP Public Clud, and any v1 Openstack implementatin. - F-Respnse Enterprise Management Cnsle nw crrectly detects Apple OSX 10.8 target cmputers and deplys the apprpriate sftware. - F-Respnse Cnsultant + Cvert is nw better able t detect Windws machines even if they are running SSH/SFTP services. - Imprved handling f deplyment t remte Windws machines with nn-standard rt directries and paths. - New Exprt MSI ptin exprts the F-Respnse target executable and cnfiguratin file alng with all necessary settings t a simple Micrsft Installer which can be easily deplyed t target machines using 3 rd party deplyment tls. Changes affecting all versins f F-Respnse - F-Respnse Apple OSX executables nw signed with registered Apple Develper certificate. - F-Respnse Linux and Apple OSX executables nw able t better detect nn-standard device paths and munt pints and autmatically add these as available targets. - Thanks t assistance frm AArn Walters, Michael Ligh, and the Vlatility Prject, F- Respnse Physical Memry access nw has greatly imprved stability in large memry envirnments. F-Respnse cntains the fllwing new features and enhancements: Changes affecting Enterprise and Cnsultant + Cvert Editin 103

104 - F-Respnse Enterprise nw includes supprt fr 64bit Linux platfrms. - F-Respnse Enterprise Management Cnsle nw crrectly detects Apple OSX 10.7 target cmputers and deplys the apprpriate sftware. - F-Respnse Flexdisk updated with minr API crrectins based n user feedback. - F-Respnse Enterprise Service Uninstall issue addressed, remved ptential service marked fr deletin issue. - Updated Spanish language text as per user input. Changes affecting Cnsultant Editin - F-Respnse Cnsultant Editin updated t address ptential service marked fr deletin issue. - F-Respnse Flexdisk updated with minr API crrectins based n user feedback. - F-Respnse Cnsultant Editin nw includes supprt fr 64bit Linux platfrms. Changes affecting Field Kit Editin - F-Respnse Field Kit Editin updated t address ptential service marked fr deletin issue. F-Respnse cntains the fllwing new features and enhancements: Changes affecting Enterprise Editin - Enterprise Encryptin is nw updated t prperly handle lgical vlumes and +2TB devices. Changes affecting Cnsultant Editin - Imprved handling f > 2TB disks fr nn-windws platfrms. Changes affecting Field Kit Editin - Imprved handling f > 2TB disks fr nn-windws platfrms. F-Respnse cntains the fllwing new features and enhancements: Changes affecting Enterprise Editin - F-Respnse Enterprise nw prvides the ptin t encrypt all read actins directed t remte targets. Encryptin is AES using 256 bit keys. Encryptin is ptinal and can be enabled r disabled. Encryptin requires Windws Vista r better n the Examiner machine, ie the machine running either the FEMC r the F-Respnse Acceleratr. - F-Respnse Flexdisk updated with new prgrammable API. Flexdisk nw has prgrammable API using simple RESTful web methds and JSON text encding. Mre infrmatin n the Flexdisk API is available in the API dcument n the Dwnlads page f the F-Respnse website. - F-Respnse Flexdisk fr Linux nw autdetects mre munt pints and lgical vlumes. - Updates t the F-Respnse Enterprise COM Scripting bject t supprt Flexdisk cnfiguratin ptins. - Imprved handling f > 2TB disks fr nn-windws platfrms. - F-Respnse Enterprise fr AIX and SCO nw mre accurately lcates and presents physical devices. 104

105 Changes affecting Cnsultant Editin - F-Respnse Flexdisk updated with new prgrammable API. Flexdisk nw has prgrammable API using simple RESTful web methds and JSON text encding. Mre infrmatin n the Flexdisk API is available in the API dcument n the Dwnlads page f the F-Respnse website. - F-Respnse Flexdisk fr Linux nw autdetects mre munt pints and lgical vlumes. - Imprved handling f > 2TB disks fr nn-windws platfrms. - F-Respnse Cnsultant fr AIX and SCO nw mre accurately lcates and presents physical devices. Changes affecting Field Kit Editin - Imprved handling f > 2TB disks fr nn-windws platfrms. leratr. - F-Respnse Flexdisk updated with new prgrammable API. Flexdisk nw has prgrammable API using simple RESTful web methds and JSON text encding. Mre infrmatin n the Flexdisk API is available in the API dcument n the Dwnlads page f the F-Respnse website. - F-Respnse Flexdisk fr Linux nw autdetects mre munt pints and lgical vlumes. - Updates t the F-Respnse Enterprise COM Scripting bject t supprt Flexdisk cnfiguratin ptins. - Imprved handling f > 2TB disks fr nn-windws platfrms. - F-Respnse Enterprise fr AIX and SCO nw mre accurately lcates and presents physical devices. F-Respnse cntains the fllwing new features and enhancements: Changes affecting Enterprise Editin - F-Respnse Enterprise Management Cnsle (FEMC) nw prvides rapid deplyments ptins which cndense the standard deplyment steps. Install/Start F-Respnse Will install, start, and issue discvery against a remte F-Respnse target. Stp/Remve F-Respnse Will stp and remve F-Respnse frm a remte target. - Added an Active Clients menu t allw fr the selective enabling r disabling f the standard cntinuus plling mechanism used t update active clients. - Added an Exprt ptin t the Deplyment Optins dialg t make the manual deplyment prcess easier. Exprt buttn will allw the user t save ff a cpy f the ini file and selected executable prepared fr manual deplyment. - Added the new patent pending F-Respnse Flexdisk capabilities t F-Respnse Enterprise Windws, Linux, and OSX (Apple) targets. - Added the new F-Respnse Acceleratr t allw many-t-many cnnectivity fr F- Respnse Enterprise and Cnsultant custmers. Changes affecting Cnsultant Editin 105

106 - Mdified the F-Respnse Cnsultant Cnnectr (FCC) t imprve respnsiveness. - Added the new patent pending F-Respnse Flexdisk capabilities t F-Respnse Cnsultant Windws, Linux, and OSX (Apple) targets. - Added the new F-Respnse Acceleratr t allw many-t-many cnnectivity fr F- Respnse Enterprise and Cnsultant custmers. F-Respnse cntains the fllwing new features and enhancements: Changes affecting All Versins - F-Respnse (All Versins) nw prvides supprt fr accessing physical disks > 2TB, theretical limit f 8+ Zettabytes. - Mdificatins t crrect authenticatin/lgin/lgut issues when cnnecting frm Linux (pen-iscsi). Changes affecting Enterprise Editin - Adjustments t the F-Respnse Enterprise Management Cnsle(FEMC) t supprt different IP Address cnfiguratins. - Added lgic t handle F-Respnse Deplyment t remte target machines using a nnstandard rt drive. - F-Respnse License Manager Mnitr (LMM) nw pens the dialg autmatically n first lad. - Addressed an issue with crrectly handling alternate prt selectin frm the cmmand line r via cnfigure ptins. - Icn display crrected fr FEMC Direct Cnnect fr Windws targets. - F-Respnse License Manager nw autmatically ppulates Validatin Prt and IP in Cnfigure Optins. - F-Respnse Enterprise nw prvides target supprt fr the fllwing new platfrms: Andrid (ARM) NetGear NAS (SPARC) Changes affecting Cnsultant Editin - Added aut IP detectin t the F-Respnse Cnsultant Cnnectr (FCC) t enable autmatic cnfiguratin f the F-Respnse License Manager (LM) IP Address. - F-Respnse License Manager Mnitr (LMM) nw pens the dialg autmatically n first lad. - F-Respnse License Manager nw autmatically ppulates Validatin Prt and IP in Cnfigure Optins. - F-Respnse Cnsultant nw prvides target supprt fr the fllwing new platfrms: Andrid (ARM) NetGear NAS (SPARC) 106

107 F-Respnse / cntains the fllwing new features and enhancements: Changes affecting All Versins - F-Respnse (All Windws Versins) nw prvides supprt fr accessing physical disks > 2TB, theretical limit f 8+ Zettabytes. - Crrected an issue with the 32bit Physical Memry access driver that caused stability issues in certain situatins. Changes affecting Enterprise Editin The F-Respnse Enterprise Scripting Object (FEMCCTRL) has been updated t include imprved errr handling and revised methds. Cntains updated FEMCCTRL COM Object crrected t handle Credential creatin issue and mdified Cnfigure File path. Sample scripts fr using the bject have been prvided fr Visual Basic Script, Perl, Pythn, and C#. - F-Respnse Enterprise nw prvides explicit audit lgs fr Lgin/Lgut/Failed Lgin/Start/Stp peratins n remte targets. Audit lgs are fund in the Applicatin Event Lgs f the F-Respnse License Manager. - F-Respnse Enterprise is nw fully Terminal Services/Remte Desktp aware allwing multiple users n a single machine t run the F-Respnse Enterprise Management Cnsle (FEMC) simultaneusly. - F-Respnse Enterprise nw prvides target supprt fr OpenSlaris. Changes affecting Cnsultant Editin - The F-Respnse Cnsultant Cnnectr Scripting Object (FCCCTRL) has been released with methds and prperties t autmate cnnecting t deplyed F- Respnse Cnsultant Editin Targets. Sample scripts fr using the bject have been prvided fr Visual Basic Script, Perl, and Pythn. - F-Respnse Cnsultant nw prvides target supprt fr OpenSlaris. F-Respnse cntains the fllwing new features and enhancements: Changes affecting All Versins - F-Respnse (All Versins) nw prvides supprt fr physical memry access under bth 32bit and 64bit Windws envirnments. - Added a F-Respnse Linux (< 60 Meg) Bt CDROM that prvides access t F- Respnse FK, CE, EE, and TACTICAL. Bt CDROM is available t all licensed custmers. - Crrected an issue where disk read errrs n the target side culd cause an iscsi discnnect that was nt autmatically recnnected. Changes affecting Enterprise Editin - The F-Respnse Enterprise Scripting Object (FEMCCTRL) has been updated t include imprved errr handling, additinal bjects, prperties, and methds. 107

108 Sample scripts fr using the bject have been prvided fr Visual Basic Script, Perl, Pythn, and C#. - Crrected an issue where the FEMC Unix Deplyment ptins may be incrrectly laded/presented. - Added additinal platfrm checking ptins t handle Linux and Apple OS builds returning nn-typical chipset types and prcessr cnfiguratins. F-Respnse cntains the fllwing new features and enhancements: Changes affecting Enterprise Editin - F-Respnse Enterprise nw prvides full deplyment via the Enterprise Management Cnsle (FEMC) t all supprted platfrms. - FEMC nw has bth a Credentials and Optins Cnfigure panel, including platfrm specific cnfiguratin ptins and Unix based credentials. - The Messages panel nw indicates the presence f new messages with the (!) ntatin. - The Custm Scan dialg nw presents the last custm scan perfrmed. - Micrsft iscsi Initiatr issues related t listing targets n 64bit Windws platfrms have been reslved. - The FEMC nw determines the License Manager IP Address autmatically if it is running and crrectly updates the cnfiguratin infrmatin withut user interactin. Changes affecting Cnsultant Editin - F-Respnse Cnsultant nw ffers the ptin fr cnfiguring t bind t all IP addresses (bth in autcnfigure generatin and n the CE client GUI). - The Messages panel nw indicates the presence f new messages with the (!) ntatin. - Micrsft iscsi Initiatr issues related t listing targets n 64bit Windws platfrms have been reslved. F-Respnse cntains the fllwing new features and enhancements t the Cnsultant and Enterprise Editin - F-Respnse is nw a Micrsft Winqual validated and apprved Windws 7 Cmpatible Applicatin - F-Respnse prvides additinal supprt fr the fllwing platfrms: - HP Unix (HP_UX11iv2, HP_UX11iv3) n Itanium - FreeBSD 7 n Intel/i

109 - F-Respnse nw addresses the "Unable t lgff f disk" issue in Windws Vista, 2008, and Windws 7 bth 32 and 64bit. F-Respnse cntains multiple enhancements and bug fixes fr all versins f F- Respnse, including: Changes affecting all versins - Passive Hibernatin/Suspend preventin. F-Respnse (FK, CE, EE) when running under Windws will prevent the passive hibernatin/suspend f the MUI. Active suspend/hibernatin actins (such as clsing the laptp screen, etc) will still be perfrmed Changes affecting F-Respnse Cnsultant Editin (Windws) - F-Respnse Cnsultant Cnnectr nw prvides a Clear Messages ptin that remves all text frm the Messages Panel. - F-Respnse Cnsultant Editin (f-respnse-ce.exe) nw has the ability t cmpletely hide the dialg windw n the remte machine with a simple key sequence, (ALT-CTRL-F12). This sequence will hide the GUI and restre the GUI. Changes affecting F-Respnse Enterprise Editin (Windws) - Issue in passwrd generatin fr cmmand line usage f F-Respnse Enterprise crrected. - F-Respnse Enterprise Management Cnsle nw prvides a Clear Messages ptin that remves all text frm the Messages Panel. - The F-Respnse Enterprise installatin package nw includes a partial implementatin f the F-Respnse Enterprise Management Cnsle in a language neutral fully scriptable COM bject. This bject will allw a technical user f F-Respnse Enterprise t script actins typically initiated manually in the FEMC. Fr a sample script see the C:\Prgram Files\F-Respnse\ flder. F-Respnse New Features ( All versins) - Username and Passwrd length are nw mre flexible. Username must be 1+ ANSI characters, Passwrd must be ANSI characters, in keeping in line with specificatins. New Features Cnsultant and Enterprise Editin - Minr updates t bth management cnsles reflecting the changed passwrd length criteria. Als additinal errr/infrmatinal messages in the "Messages" panel when issuing a Discvery Request, Lgin, r Lgff. - Management Cnsles will autmatically enable iscsi services n Vista+ perating systems when started (if they are nt already n). 109

110 F-Respnse New Features ( All versins) - All F-Respnse sftware (Windws) has been translated int German, Spanish, and Simplified Chinese. - Username and Passwrd length are nw mre flexible. Username must be 1+ ANSI characters, Passwrd must be 12+ ANSI characters. - All Windws based F-Respnse sftware nw includes UAC supprt fr prper prmpting under Vista, 2008, and Windws 7. New Features Cnsultant and Enterprise Editin - Minr updates t the F-Respnse License Manager, including better dngle stability, imprved errr cdes, additinal supprt fr the Windws Event Lg. - Supprt fr Sun Slaris 8, 9, 10 n SPARC. - Supprt fr IBM AIX 5.3 n Pwer5 and Pwer6. F-Respnse New Features (Cnsultant and Enterprise Editins nly) New Features Cnsultant Editin - New F-Respnse License Manager, small, faster, easier t wrk with, replaces the NetUniKey. - Updated F-Respnse Cnsultant Cnnectr - Right click cntext menus thrughut - Supprt fr remving Cnnect Tab target entries New Features Enterprise Editin - New F-Respnse License Manager, small, faster, easier t wrk with. - Updated F-Respnse Enterprise Management Cnsle - Right click cntext menus thrughut - Supprt fr remving Cnnect Tab target entries - Additinal Custm Scan ptin fr scanning by cmma separated list f machine names r IP addresses - Direct Cnnect dialg user interactin streamlined F-Respnse 3.09 cntains multiple enhancements and bug fixes fr all versins f F- Respnse, including: Changes affecting all versins - Lgical Vlume and Physical Memry(32bit Windws Only) supprt, nw F- Respnse lcates and prvides access t physical disks, lgical vlumes, and physical memry. 110

111 - Autmatic Firewall exceptins (Windws Firewall Only), F-Respnse nw creates and remves firewall exceptins autmatically. - New platfrm supprt, Linux (glibc >= 2.3.5) and Apple OSX 10.4,10.5 Changes affecting F-Respnse Cnsultant Editin - Newly released F-Respnse Cnsultant Cnnectr streamlines the prcess f cnnecting and discnnecting frm remte F-Respnse Cnsultant Editin clients. - Newly released F-Respnse License Manager (Mnitr, Service) replaces the NetUniKey server. Prvides a mre streamlined interface and imprved platfrm supprt ptins. Changes affecting F-Respnse Enterprise Editin - Newly released F-Respnse Enterprise Management Cnsle streamlines the cmplete lifecycle f F-Respnse Enterprise, deply, cnnect, discnnect, and remve F-Respnse Enterprise clients frm a single interface. - Newly released F-Respnse License Manager (Mnitr, Service) replaces the NetUniKey server. Prvides a mre streamlined interface and imprved platfrm supprt ptins. Changes affecting F-Respnse Field Kit Editin - Supprt fr Linux (glibc ) and Apple OS X 10.4, 10.5 Intel nly. F-Respnse 1.18 cntains multiple enhancements and bug fixes fr all versins f F- Respnse, including: Changes affecting all versins - Imprved handling f freign language versins f Windws. - Added supprt fr nn-standard Windws Cmputer Names. - Imprved n-lad drive prbing. - Official supprt fr the Open-iSCSI Linux Initiatr. - Un-Official supprt fr the GlbalSAN iscsi Initiatr fr Apple OSX. - Imprved thread management perfrmance. - Updated Versin infrmatin t Changes affecting F-Respnse Field Kit Editin - Graphical user interface nw includes the F-Respnse license expiratin date. Changes affecting F-Respnse Cnsultant Editin - Graphical user interface nw includes the F-Respnse license expiratin date. 111

112 - Autcnfigure ptin fr F-Respnse Cnsultant editin added, allws F- Respnse Cnsultant Editin t be run frm CD r t be prvided t IT staff with n repeated cnfiguratin needed. F-Respnse 1.17 cntains multiple enhancements and bug fixes fr all versins f F- Respnse, including: Changes affecting all versins - Mdified disk capacity return value in accrdance with SCSI parameters. - Crrected issue relating t STOP ERROR fr Micrsft iscsi Initiatr in select circumstances. - Updated Versin infrmatin t Changes affecting F-Respnse Field Kit Editin - Mdified License cntrls t allw mre leeway when dealing with inaccurate system clcks. Changes affecting F-Respnse Cnsultant Editin - Imprved perfrmance f IP validatin lk-up prcess. Changes affecting F-Respnse Enterprise Editin - Mdified iscsi Target IP selectin based n IP target fr Discvery. - Added cmmand line ptins (-a, -r) t add and remve F-Respnse Enterprise Service using user defined name. 112

113 Appendix A Overview f the F-Respnse Enterprise Editin Windws Cmmand Line Interface This appendix prvides details regarding the cmmand line ptins fr installing, uninstalling, and cnfiguring F-Respnse Enterprise n each target machine. The help text is shwn in the fllwing screen capture: F-Respnse Enterprise Editin cmmand line interface F-Respnse Enterprise editin is a GUI-less Windws Service versin f the F-Respnse Target Cde. It was designed fr ease f administratin and distributin t remte targets. The screen capture abve prvides the f-respnse-ent.exe help page, including several examples. The fllwing help text details the cmmand line ptins fr installing, uninstalling, and cnfiguring F-Respnse Enterprise n each target machine. Installing & Uninstalling F-Respnse Enterprise: -c {Create}, -d {Delete} 113

114 These ptins are mutually exclusive. They either install (-c) r uninstall (- d) the service n the lcal target cmputer with the default service name F-Respnse Enterprise Service. Nte: Yu can change the name f the F- Respnse Enterprise executable file t anything yu like prir t installatin (e.g. yu may rename f-respnse-ent.exe t xyz_tester.exe ). Yu may als place the F-Respnse Enterprise executable file anywhere yu like prir t installatin (e.g. \WINDOWS\system32). -a ( user defined service name ), -r ( user defined service name ) These ptins are mutually exclusive. They either install (-a) r uninstall (- r) the service n the lcal cmputer with a user defined service name. Nte: Yu can change the name f the F-Respnse Enterprise executable file t anything yu like prir t installatin (e.g. yu may rename frespnse-ent.exe t xyz_tester.exe ). Yu may als place the F- Respnse Enterprise executable file anywhere yu like prir t installatin (e.g. \WINDOWS\system32). Cnfiguring F-Respnse Enterprise: -s (Server IP), - (Server Prt) Since the Enterprise Editin f F-Respnse allws the F-Respnse FOB t be physically remte frm the cmputer t be analyzed, the Enterprise Editin sftware must be cnfigured with parameters identifying the netwrk address (Server IP) and prt number (Server Prt) f the cmputer t which the F-Respnse FOB is cnnected, and which is running the NetUniKey Server (ften the IP Address f an Enterprise Investigatins Server). Cmpleting a successful cnfiguratin creates a NetUniKey.ini file. Fr successful executin f F-Respnse Enterprise, bth the F-Respnse Enterprise executable ( f-respnse-ent.exe by default) and the NetUniKey.ini file must be lcated in the same flder n the target cmputer. -u (username), -p (passwrd), -i (iscsi Prt), -f (Flexdisk Prt) These ptins set the username, passwrd, and iscsi prt that will be used fr remte cnnectivity by the iscsi initiatr. If the Flexdisk prt is nt specified it will nt be enabled. 114

115 F-Respnse Enterprise Editin Service Management Cnsle interface The F-Respnse Enterprise service is cntrlled via the Micrsft Management Cnsle fr Services. By default the service is installed in the Manual psitin, such that it may be started during an investigatin and stpped when n lnger needed. Once installed and cnfigured, the service need nly be started each time it is t be used. The default service name F-Respnse Enterprise Service can be replaced with a user defined service name during installatin with the -a ptin. 115

116 Appendix B Overview f the F-Respnse Enterprise Editin Unix Cmmand Line Interface F-Respnse Cnsultant/Enterprise (<PLATFORM>),(Versin ) Usage: -h This help page. -a </path/t/devices> Path t additinal devices (Cmma separated, ex /dev/md0,/dev/md1) -S <F-RespnseLM IP> IP Address f F-Respnse LM Server -P <F-RespnseLM Prt> TCP Prt f F-Respnse LM Server, ptinal, defaults t u <username> F-Respnse username, must be 8 characters -p <passwrd> F-Respnse passwrd, must be 14 characters -i <iscsi Prt> iscsi Prt, ptinal, defaults t c <path/t/frespnse.ini> Optinal autcnfigure path, if used n ther cmmandline ptins are required F-Respnse Cnsultant/Enteprise Editin can either be run directly frm the cmmandline (using the varius arguments indicated abve, r it can be run with the -c <path/t/frespnse.ini> ptin prvided the path pints t a valid frespnse.ini file. See the F-Respnse Cnsultant Cnnectr autcnfigure ptin t generate a valid "frespnse.ini" The F-Respnse Enterprise Editin fr Linux, Apple OS X, HP_UX, AIX, Sun Slaris, and FreeBSD is installed and available in the C:\Prgram Files\F-Respnse\F-Respnse Enterprise Editin\ flder. The executable name will indicate which versin is apprpriate fr yur target platfrm. F-Respnse Enterprise Editin fr Linux f-respnse-ce-e-lin F-Respnse Enterprise Editin fr Apple OSX (10.3, 10.4, 10.5 Intel & PPC) f- respnse-ce-e-sx F-Respnse Enterprise Editin fr Sun Slaris f-respnse-ce-e-sun F-Respnse Enterprise Editin fr IBM AIX (Pwer) f-respnse-ce-e-aix-p5 F-Respnse Enterprise Editin fr HP Unix f-respnse-ce-e-hpux 116

117 F-Respnse Enterprise Editin fr FreeBSD f-respnse-ce-e-fbsd F-Respnse Enterprise Editin fr SCO Unix f-respnse-ce-e-sc Example Usage: Scenari #1 F-Respnse License Manager Server n , Prt sud./f-respnse-ce-e-lin S P 5681 u mshannn p mshannn i 3260 Scenari #2 F-Respnse Autcnfigure file frespnse.ini created using F-Respnse Cnsultant Cnnectr sud./f-respnse-ce-e-lin c./frespnse.ini Scenari #3 F-Respnse Autcnfigure file f-respnse-ent.exe.ini created by the F- Respnse FEMC Cnsle fllwing a successful Cnfiguratin (C:\Prgram Files\F- Respnse\F-Respnse Enterprise\f-respnse-ent.exe.ini) sud./f-respnse-ce-e-lin c./frespnse.ini 117

118 Appendix C Overview f the F-Respnse Cnsultant User Interface This appendix prvides an explanatin f the fields presented by the F-Respnse Cnsultant User Interface, which is presented upn executin f the F-Respnse Cnsultant Editin User Interface Target cde n the cmputer t be analyzed. F-Respnse Cnsultant Editin User Interface An explanatin f the fields presented by the F-Respnse Cnsultant Editin Target cde is as fllws: Hst Infrmatin Hstname This is the Machine Name r Hst Name f the lcal machine upn which the F-Respnse Target cde has been run. Hst IP Address This is a drp dwn listing f the IP addresses cnfigured n this lcal Target machine. If there are multiple addresses present yu shuld select the ne mst readily accessible as this will be the address yu cnnect t frm yur remte analysis machine via the Initiatr. Remte Cnfiguratin TCP Prt 118

119 This is the TCP prt yur remte r Initiatr cmputer will use t cnnect t the lcal machine. The iscsi default is 3260; hwever yu may assign anther available TCP prt if desired. Username The iscsi prtcl requires a username fr the remte Initiatr cmputer cnnectin. The username selected must be ne r mre characters in length. This username will be used n the remte Initiatr cmputer t access the lcal r Target machine s hard drives. Passwrd The iscsi prtcl requires a passwrd fr the remte Initiatr cmputer cnnectin. The passwrd selected must be 12 r mre characters in length. This passwrd will be used n the remte Initiatr cmputer t access the lcal r Target machine s hard drives. Versin This is the versin f F-Respnse Cnsultant Editin target cde that yu are using; in this case Versin

120 Appendix D Overview f the F-Respnse Field Kit User Interface This appendix prvides an explanatin f the fields presented by the F-Respnse Field Kit User Interface, which is presented upn executin f the F-Respnse Field Kit User Interface Target cde n the cmputer t be analyzed. F-Respnse Field Kit Editin User Interface An explanatin f the fields presented by the F-Respnse Field Kit Editin Target cde is as fllws: Hst Infrmatin Hstname This is the Machine Name r Hst Name f the lcal machine upn which the F-Respnse Target cde has been run. Hst IP Address This is a drp dwn listing f the IP addresses cnfigured n this lcal Target machine. If there are multiple addresses present yu shuld select the ne mst readily accessible as this will be the address yu cnnect t frm yur remte analysis machine via the Initiatr. Remte Cnfiguratin 120

121 TCP Prt This is the TCP prt yur remte r Initiatr cmputer will use t cnnect t the lcal machine. The iscsi default is 3260, hwever yu may assign anther available TCP prt if desired. Username The iscsi prtcl requires a username fr the remte Initiatr cmputer cnnectin. The username selected must be ne r mre characters in length. This username will be used n the remte Initiatr cmputer t access the lcal r Target machine s hard drives. Passwrd The iscsi prtcl requires a passwrd fr the remte Initiatr cmputer cnnectin. The passwrd selected must be exactly 12 r mre characters in length. This passwrd will be used n the remte Initiatr cmputer t access the lcal r Target machine s hard drives. Versin This is the versin f F-Respnse Field Kit Editin target cde that yu are using; in this case Versin License Key HW ID This is the Hardware ID f yur F-Respnse FOB. This ID number is required when upgrading r renewing yur F-Respnse sftware license. License Expires This is the expiratin date f the license encded t yur F-Respnse FOB. This number will appear in red when yur F-Respnse sftware license is due t expire within 30 days. 121

122 Appendix E Understanding Unix Credentials F-Respnse uses Unix Credentials and the Secure Shell service (SSH/SFTP) t access remte nn-windws based machines. In rder t utilize this service yu ll want t familiarize yurself with Unix credentials. User accunts and Credentials Fr ur purpses there are tw different user accunts we can use t gain sufficient access t a target nn-windws based machine, a general user accunt, and rt. In the Unix wrld rt is the superuser r Administratr. As yu can imagine using the superuser r rt accunt can be dangerus therefre mst system administratrs allw general user accunt t perfrm actins requiring rt level permissin thrugh ne f tw ptins, su and sud. Assume User (su) Using su a general user accunt can assume superuser privileges fr a limited perid f time. The user will require the rt r superuser passwrd t gain these privileges, and nce the su actin is cmplete the user will effectively be able t perfrm any and all actins as rt r superuser. It is smetimes easiest t think f this prcess much like Windws User Accunt Cntrls (Windws UAC) in Micrsft Windws Vista and 7, yu are asked t use su as an extra step in an effrt t make yu cgnitive f the pwerful capabilities yur accunt nw pssesses. Superuser d (sud) Using sud a general user is allwed t execute a specific cmmand with superuser privileges. In this instance the user need nly enter their user passwrd when prmpted. Again, much like the Windws UAC prcess, yu are asked t use sud as an extra step in an effrt t make yu aware f the actins yur accunt is temprarily capable f. SSH Keys Many system administratrs prefer t allw remte cnnectins nly when they are attempted using a special cryptgraphic key file, the SSH Key File. F-Respnse allws yu t specify a key file fr access, hwever unless yur accunt is the rt r superuser 122

123 accunt yu will need t prvide the apprpriate passwrd fr su r sud. F-Respnse supprts bth OpenSSH and Putty SSH Key files. F-Respnse allws yu t access the remte machine with any cmbinatin f user accunt and credential, hwever let s g thrugh a few cmmn scenaris belw: Using the rt r superuser accunt with a passwrd Using the rt r superuser accunt with an SSH Key (OpenSSH r Putty) Using a general user accunt, sud, and a user passwrd fr access and sud permissins 123

124 Using a general user accunt, sud, and a user passwrd fr sud permissins plus an SSH Key fr access Using a general user accunt, su, and a user passwrd fr access plus the rt passwrd fr su permissins Using a general user accunt, su, and a SSH key fr access plus the rt passwrd fr su permissins 124

125 Appendix F Sftware Requirements n the Target Cmputer The fllwing utlines what sftware, services, and credentials are required t cnnect t a remte target cmputer via the F-Respnse Enterprise Management Cnsle (FEMC) Windws (All Versins) Sftware N additinal Services File and Printer Sharing (Micrsft Services TCP Prt 445) Credentials Unix (All Versins) Administratr r like permissin sufficient t create a LcalSystem level service Sftware N additinal Services SSH with SFTP Subsystem services available Credentials User accunt capable f assuming superuser privileges, r superuser accunt Platfrm Specific Ntes Apple SSH is nt enabled by default n Apple OSX, hwever it can be enabled via the System Preferences via the Remte Lgin Service. The exact lcatin f this ptin will vary by perating system release and versin. 125

126 Appendix G F-Respnse Target Naming Cnventin The fllwing utlines the F-Respnse Target naming cnventin: All Platfrms iqn cm.f-respnse.hostname. Windws Physical Disk disk-x (where x is the physical disk number) Lgical Vlume vl-x (where x is the lgical vlume letter) Physical Memry pmem Nn-Windws Physical Disk <disk name> (platfrm dependent) 126

127 Appendix H -- Icn Legend Icn Platfrm Name Details Nne Netwrk Dmain r Wrkgrup Icn indicates a Netwrk Dmain r Wrkgrup, cmputers listed under this icn have identified themselves as being a member f the grup. Unknwn Unknwn Icn indicates this cmputer platfrm is unknwn r valid credentials culd nt be established, check the Messages tab fr further details. Apple Apple F- Respnse Nt Installed Icn indicates an Apple Cmputer, if n badge is present the Apple cmputer is available and des nt have F-Respnse Installed. If a badge is present check the badge legend belw fr further details. FreeBSD FreeBSD F- Respnse Nt Installed Icn indicates a FreeBSD Cmputer, if n badge is present the FreeBSD cmputer is available and des nt have F-Respnse Installed. If a badge is present check the badge legend belw fr further details. HPUX HP Unix F- Respnse Nt Installed Icn indicates a HP Unix Cmputer, if n badge is present the HP Unix cmputer is available and des nt have F-Respnse Installed. If a badge is present check the badge legend belw fr further details. AIX IBM AIX F- Respnse Nt Installed Icn indicates a IBM AIX Cmputer, if n badge is present the AIX cmputer is available and des nt have F-Respnse Installed. If a badge is present check the badge legend belw fr further details. 127

128 Linux Linux F- Respnse Nt Installed Icn indicates a Linux Cmputer, if n badge is present the Linux cmputer is available and des nt have F-Respnse Installed. If a badge is present check the badge legend belw fr further details. SCO SCO Unix F- Respnse Nt Installed Icn indicates a SCO Unix Cmputer, if n badge is present the SCO cmputer is available and des nt have F-Respnse Installed. If a badge is present check the badge legend belw fr further details. Slaris/OpenSlaris (SunOS) Sun Slaris F- Respnse Nt Installed Icn indicates a Sun Slaris Cmputer, if n badge is present the Slaris cmputer is available and des nt have F-Respnse Installed. If a badge is present check the badge legend belw fr further details. Windws Windws F- Respnse Nt Installed Icn indicates a Windws Cmputer, if n badge is present the Windws cmputer is available and des nt have F-Respnse Installed. If a badge is present check the badge legend belw fr further details. GreyScale Icn(s) All Platfrms Machine nt accessible A grayscale icn indicates the target cmputer is nt accessible with the credentials prvided. Badges (appear ver icns) Badge Name Details F-Respnse Started This badge indicates F-Respnse has been started n the target Cmputer. 128

129 F-Respnse Stpped This badge indicates F-Respnse has been stpped n the target Cmputer. 129

130 Appendix I Master Sftware License Agreement AGILE RISK MANAGEMENT LLC MASTER SOFTWARE LICENSE AGREEMENT TERMS AND CONDITIONS 1. Scpe f Agreement; Definitins. This Agreement cvers the license and permitted use f the Agile Risk Management LLC ( Agile ) F-Respnse Sftware. Unless therwise defined in this sectin, the capitalized terms used in this Agreement shall be defined in the cntext in which they are used. The fllwing terms shall have the fllwing meanings: 1.1. Agile Sftware r Sftware means any and all versins f Agile s F-Respnse sftware and the related "Dcumentatin" as defined belw Custmer r "Licensee" means the persn r entity identified n the invice and nly such persn r entity, Custmer shall nt mean any assigns, heirs, r related persns r entities r claimed third-party beneficiaries f the Custmer Dcumentatin means Agile release ntes r ther similar instructins in hard cpy r machine readable frm supplied by Agile t Custmer that describes the functinality f the Agile Sftware License Term means the term f the applicable license as specified n an invice r as set frth in this Agreement. 2. Grant f Sftware License Enterprise License. Subject t the terms and cnditins f this Agreement nly, Agile grants Custmer a nn-exclusive, nn-transferable license t install the Agile Sftware and t use the Agile Sftware during the License Term, in bject cde frm nly Third Party Sftware. Custmer acknwledges that the Agile Sftware may include r require the use f sftware prgrams created by third parties, and the Custmer acknwledges that its use f such third party sftware prgrams shall be gverned exclusively by the third party s applicable license agreement. 3. Sftware License Restrictins N Reverse Engineering; Other Restrictins. Custmer shall nt, directly r indirectly: (i) sell, license, sublicense, lease, redistribute r transfer any Agile Sftware; (ii) mdify, translate, reverse engineer, decmpile, disassemble, create derivative wrks based n, r distribute any Agile Sftware; (iii) rent r lease any rights in any Agile Sftware in any frm t any entity; (iv) remve, alter r bscure any prprietary ntice, labels r marks n any Agile Sftware. Custmer is respnsible fr all use f the Sftware and fr cmpliance with this Agreement and any applicable third party sftware license agreement Intellectual Prperty. Agile retains all title, patent, cpyright and ther intellectual prprietary rights in, and wnership f, the Agile Sftware regardless f the type f access r media upn which the riginal r any cpy may be recrded r fixed. Unless therwise expressly stated 130

131 herein, this Agreement des nt transfer t Custmer any title, r ther wnership right r interest in any Agile Sftware. Custmer des nt acquire any rights, express r implied, ther than thse expressly granted in this Agreement. 4. Ordering & Fulfillment. Unless therwise set frth in an Agile-generated Estimate pricing is set frth n the F-Respnse website and is subject t change at any time. Each rder shall be subject t Agile s reasnable acceptance. Unless therwise set frth in an Agile generated Estimate. Delivery terms are FOB Agile s shipping pint. 5. Payments. Custmer agrees t pay amunts inviced by Agile fr the license granted under this Agreement. If any authrity impses a duty, tax r similar levy (ther than taxes based n Agile s incme), Custmer agrees t pay, r t prmptly reimburse Agile fr, all such amunts. Unless therwise indicated in an invice, all Agile invices are payable thirty (30) days frm the date f the invice. Agile reserves the right t charge and Custmer agrees t pay Agile fr every unauthrized cpy r unauthrized year an amunt equal t the cst per cpy, per year, per cmputer, r per user, whichever is greater, as a late payment fee in the event Custmer fails t remit payments when due r Custmer therwise vilates the payment prvisins f this Agreement. In additin t any ther rights set frth in this Agreement, Agile may suspend perfrmance r withhld fulfilling new Custmer rders in the event Custmer has failed t timely remit payment fr utstanding and past due invices. 6. Cnfidentiality Definitin. Cnfidential Infrmatin means: (a) any nn-public technical r business infrmatin f a party, including withut limitatin any infrmatin relating t a party s techniques, algrithms, sftware, knw-hw, current and future prducts and services, research, engineering, vulnerabilities, designs, financial infrmatin, prcurement requirements, manufacturing, custmer lists, business frecasts, marketing plans and infrmatin; (b) any ther infrmatin f a party that is disclsed in writing and is cnspicuusly designated as Cnfidential at the time f disclsure r that is disclsed rally and is identified as Cnfidential at the time f disclsure; r (c) the specific terms and cnditins f this Agreement Exclusins. Cnfidential Infrmatin shall nt include infrmatin which: (i) is r becmes generally knwn t the public thrugh n fault r breach f this Agreement by the receiving Party; (ii) the receiving Party can demnstrate by written evidence was rightfully in the receiving Party s pssessin at the time f disclsure, withut an bligatin f cnfidentiality; (iii) is independently develped by the receiving Party withut use f r access t the disclsing Party's Cnfidential Infrmatin r therwise in breach f this Agreement; (iv) the receiving Party rightfully btains frm a third party nt under a duty f cnfidentiality and withut restrictin n use r disclsure, r (v) is required t be disclsed pursuant t, r by, any applicable laws, rules, regulatry authrity, curt rder r ther legal prcess t d s, prvided that the Receiving Party shall, prmptly upn learning that such disclsure is required, give written ntice f such disclsure t the Disclsing Party Obligatins. Each Party shall maintain in cnfidence all Cnfidential Infrmatin f the disclsing Party that is delivered t the receiving Party and will nt use such Cnfidential Infrmatin except as expressly permitted herein. Each Party will take all reasnable measures t maintain the cnfidentiality f such Cnfidential Infrmatin, but 131

132 in n event less than the measures it uses t prtect its wn Cnfidential Infrmatin. Each Party will limit the disclsure f such Cnfidential Infrmatin t thse f its emplyees with a bna fide need t access such Cnfidential Infrmatin in rder t exercise its rights and bligatins under this Agreement prvided that all such emplyees are bund by a written nn-disclsure agreement that cntains restrictins at least as prtective as thse set frth herein Injunctive Relief. Each Party understands and agrees that the ther Party will suffer irreparable harm in the event that the receiving Party f Cnfidential Infrmatin breaches any f its bligatins under this sectin and that mnetary damages will be inadequate t cmpensate the nn-breaching Party. In the event f a breach r threatened breach f any f the prvisins f this sectin, the nn-breaching Party, in additin t and nt in limitatin f any ther rights, remedies r damages available t it at law r in equity, shall be entitled t a temprary restraining rder, preliminary injunctin and/r permanent injunctin in rder t prevent r t restrain any such breach by the ther Party. 7. DISCLAIMER OF WARRANTIES. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, AGILE AND ITS SUPPLIERS PROVIDE THE SOFTWARE AND SUPPORT SERVICES (IF ANY) AS IS AND WITH ALL FAULTS, AND HEREBY DISCLAIM ALL OTHER WARRANTIES AND CONDITIONS, WHETHER EXPRESS, IMPLIED OR STATUTORY, INCLUDING, BUT NOT LIMITED TO, ANY (IF ANY) IMPLIED WARRANTIES, DUTIES OR CONDITIONS OF MERCHANTABILITY, OF FITNESS FOR A PARTICULAR PURPOSE, OF RELIABILITY OR AVAILABILITY, OF ACCURACY OR COMPLETENESS OF RESPONSES, OF RESULTS, OF WORKMANLIKE EFFORT, OF LACK OF VIRUSES, AND OF LACK OF NEGLIGENCE, ALL WITH REGARD TO THE SOFTWARE, AND THE PROVISION OF OR FAILURE TO PROVIDE SUPPORT OR OTHER SERVICES, INFORMATION, SOFTWARE, AND RELATED CONTENT THROUGH THE SOFTWARE OR OTHERWISE ARISING OUT OF THE USE OF THE SOFTWARE. ALSO, THERE IS NO WARRANTY OR CONDITION OF TITLE, QUIET ENJOYMENT, QUIET POSSESSION, CORRESPONDENCE TO DESCRIPTION OR NON-INFRINGEMENT WITH REGARD TO THE SOFTWARE. 8. Limitatins and Exclusins Limitatin f Liability and Remedies. NOTWITHSTANDING ANY DAMAGES THAT YOU MIGHT INCUR FOR ANY REASON WHATSOEVER (INCLUDING, WITHOUT LIMITATION, ALL DAMAGES REFERENCED ABOVE AND ALL DIRECT OR GENERAL DAMAGES IN CONTRACT OR ANY OTHER THEORY IN LAW OR IN EQUITY), THE ENTIRE LIABILITY OF EITHER PARTY AND WITH RESPECT TO AGILE, ANY OF ITS SUPPLIERS, UNDER ANY PROVISION OF THIS AGREEMENT AND THE EXCLUSIVE REMEDY HEREUNDER SHALL BE LIMITED TO THREE TIMES THE TOTAL AMOUNT PAID BY CUSTOMER FOR THE LICENSE; PROVIDED, HOWEVER THAT THIS LIMITATION DOES NOT APPLY TO ANY OF THE FOLLOWING: (A) A PARTY S BREACH OF ITS CONFIDENTIALITY OBLIGATIONS UNDER THIS AGREEMENT; OR (B) ANY GROSS NEGLIGENCE OR WILLFUL MISCONDUCT BY A PARTY. THE FOREGOING LIMITATIONS, EXCLUSIONS AND DISCLAIMERS SHALL APPLY TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, EVEN IF ANY REMEDY FAILS ITS ESSENTIAL PURPOSE Exclusin f Incidental, Cnsequential and Certain Other Damages. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT SHALL EITHER PARTY, AND WITH RESPECT TO AGILE, ITS SUPPLIERS, BE LIABLE TO THE OTHER FOR ANY SPECIAL, INCIDENTAL, PUNITIVE, INDIRECT, OR CONSEQUENTIAL DAMAGES WHATSOEVER (INCLUDING, BUT NOT LIMITED TO, DAMAGES FOR LOSS OF PROFITS, FOR BUSINESS 132

133 INTERRUPTION, FOR PERSONAL INJURY, FOR LOSS OF PRIVACY, FOR FAILURE TO MEET ANY DUTY INCLUDING OF GOOD FAITH OR OF REASONABLE CARE, AND FOR ANY OTHER PECUNIARY OR OTHER LOSS WHATSOEVER) ARISING OUT OF OR IN ANY WAY RELATED TO THE USE OF OR INABILITY TO USE THE SOFTWARE, THE PROVISION OF OR FAILURE TO PROVIDE SUPPORT OR OTHER SERVICES, INFORMATION, SOFTWARE, AND RELATED CONTENT THROUGH THE SOFTWARE OR OTHERWISE ARISING OUT OF THE USE OF THE SOFTWARE, OR OTHERWISE UNDER OR IN CONNECTION WITH ANY PROVISION OF THIS AGREEMENT, EVEN IN THE EVENT OF THE FAULT, TORT (INCLUDING NEGLIGENCE), MISREPRESENTATION, STRICT LIABILITY, BREACH OF CONTRACT OR BREACH OF WARRANTY OF AGILE OR ANY SUPPLIER, AND EVEN IF AGILE OR ANY SUPPLIER HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. IN NO EVENT WILL EITHER PARTY BE LIABLE TO THE OTHER PARTY OR TO ANY THIRD PARTY FOR ANY INDIRECT, INCIDENTAL, SPECIAL OR CONSEQUENTIAL, DAMAGES (INCLUDING WITHOUT LIMITATION, LIABILITIES RELATED TO A LOSS OF USE, PROFITS, GOODWILL OR SAVINGS OR A LOSS OR DAMAGE TO ANY SYSTEMS, RECORDS OR DATA), WHETHER SUCH LIABILITY ARISES FROM ANY CLAIM BASED UPON CONTRACT, WARRANTY, TORT (INCLUDING NEGLIGENCE), PRODUCT LIABILITY OR OTHERWISE, EVEN IF ADVISED IN ADVANCE OR AWARE OF THE POSSIBILITY OF ANY SUCH LOSS OR DAMAGE. THE FOREGOING LIMITATIONS OF LIABILITY WILL NOT APPLY TO ANY OF THE FOLLOWING: (A) A PARTY S BREACH OF ITS CONFIDENTIALITY OBLIGATIONS UNDER THIS AGREEMENT; OR (B) ANY GROSS NEGLIGENCE OR WILLFUL MISCONDUCT BY A PARTY Indemnificatin. Licensr hereby agrees t indemnify, hld harmless and defend Licensee and any partner, principal, emplyee r agent theref against all claims, liabilities, lsses, expenses (including attrney's fees and legal expenses related t such defense), fines, penalties, taxes r damages (cllectively "Liabilities") asserted by any third party where such Liabilities arise ut f r result frm: (1) any claim that the Sftware r Custmer s use theref vilates any cpyright, trademark, patent and/r any ther intellectual prperty rights; (2) the negligence f Licensr in the curse f prviding any Services hereunder; r (3) the representatins r warranties made by Licensr hereunder, r their breach. Licensee shall prmptly ntify Licensr f any third party claim and Licensr shall, at Licensee's ptin, cnduct the defense in any such third party actin arising as described herein at Licensr's sle expense and Licensee shall cperate with such defense. 9. Verificatin Agile has the right t request Custmer cmplete a self-audit questinnaire in a frm prvided by Agile. If an audit reveals unlicensed use f the Agile Sftware, Custmer agrees t prmptly rder and pay fr licenses t permit all past and nging usage. 10. Supprt Services Rights and Obligatins. This Agreement des nt bligate Agile t prvide any supprt services r t supprt any sftware prvided as part f thse services. If Agile des prvide supprt services t yu, use f any such supprt services is gverned by the Agile plicies and prgrams described in the user manual, in nline dcumentatin, n Agile s supprt webpage, r in ther Agile-prvided materials. Any sftware Agile may prvide yu as part f supprt services are gverned by this Agreement, unless separate terms are prvided. 133

134 10.2. Cnsent t Use f Data. Yu agree that Agile and its affiliates may cllect and use technical infrmatin gathered as part f the supprt services prvided t yu, if any, related t the Sftware. Agile may use this infrmatin slely t imprve ur prducts r t prvide custmized services r technlgies t yu and will nt disclse this infrmatin in a frm that persnally identifies yu. 11. Miscellaneus Legal Cmpliance; Restricted Rights. Each Party agrees t cmply with all applicable Laws. Withut limiting the freging, Custmer agrees t cmply with all U.S. exprt Laws and applicable exprt Laws f its lcality (if Custmer is nt lcated in the United States), and Custmer agrees nt t exprt any Sftware r ther materials prvided by Agile withut first btaining all required authrizatins r licenses. In the event the Sftware is prvided t the United States gvernment it is prvided with nly LIMITED RIGHTS and RESTRICTED RIGHTS as defined in FAR if the cmmercial terms are deemed nt t apply Gverning Law; Severability. This Agreement (including any addendum r amendment t this Agreement which is included with the Sftware) are the entire agreement between yu and Agile relating t the Sftware and the supprt services (if any) and they supersede all prir r cntempraneus ral r written cmmunicatins, prpsals and representatins with respect t the Sftware r any ther subject matter cvered by this Agreement. T the extent the terms f any Agile plicies r prgrams fr supprt services cnflict with the terms f this Agreement, the terms f this Agreement shall cntrl. This Agreement shall be gverned by the laws f the State f Flrida, USA, withut regard t chice-f-law prvisins. Yu and Agile agree t submit t the persnal and exclusive jurisdictin f the Flrida state curt lcated in Tampa, Flrida, and the United States District Curt fr the Middle District f Flrida. If any prvisin f this Agreement is held t be illegal r unenfrceable fr any reasn, then such prvisin shall be deemed t be restated s as t be enfrceable t the maximum extent permissible under law, and the remainder f this Agreement shall remain in full frce and effect. Custmer and Agile agree that this Agreement shall nt be gverned by the U.N. Cnventin n Cntracts fr the Internatinal Sale f Gds Ntices. Any ntices under this Agreement will be persnally delivered r sent by certified r registered mail, return receipt requested, r by natinally recgnized vernight express curier, t the address specified herein r such ther address as a Party may specify in writing. Such ntices will be effective upn receipt, which may be shwn by cnfirmatin f delivery Assignment. Custmer may nt assign r therwise transfer this Agreement withut the Agile s prir written cnsent, which cnsent shall nt be unreasnably withheld, cnditined r delayed. This Agreement shall be binding upn and inure t the benefit f the Parties successrs and permitted assigns, if any Frce Majeure. Neither Party shall be liable fr any delay r failure due t a frce majeure event and ther causes beynd its reasnable cntrl. This prvisin shall nt apply t any f Custmer s payment bligatins Redistributin Cmpliance. 134

135 (a) F-Respnse distributes sftware libraries develped by The Sleuth Kit ("TSK"). The license infrmatin and surce cde fr TSK can be fund at If any changes have been made by Agile t the TSK libraries distributed with the F- Respnse sftware, thse changes can be fund nline at (b) A prtin f the F-Respnse Sftware was derived using surce cde prvided by multiple 3rd parties which requires the fllwing ntices be psted herein, and which applies nly t the surce cde. F-Respnse cde is distributed nly in binary r bject cde frm. F-Respnse surce cde, and any revised 3rd party cde cntained within the F-Respnse surce cde, is nt available fr distributin. The name f 3rd parties included belw are nt being used t endrse r prmte this prduct, nr is the name f the authr being used t endrse r prmte this prduct. This infrmatin is presented slely t cmply with the required license agreements which require reprductin f the fllwing cpyright ntice, list f cnditins and disclaimer: Cpyright (c) Petri Lehtinen <petri@digip.rg> Permissin is hereby granted, free f charge, t any persn btaining a cpy f this sftware and assciated dcumentatin files (the "Sftware"), t deal in the Sftware withut restrictin, including withut limitatin the rights t use, cpy, mdify, merge, publish, distribute, sublicense, and/r sell cpies f the Sftware, and t permit persns t whm the Sftware is furnished t d s, subject t the fllwing cnditins: The abve cpyright ntice and this permissin ntice shall be included in all cpies r substantial prtins f the Sftware. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. ==================================================================== Cpyright (c) The OpenSSL Prject. All rights reserved. 135

136 Redistributin and use in surce and binary frms, with r withut mdificatin, are permitted prvided that the fllwing cnditins are met: 1. Redistributins f surce cde must retain the abve cpyright ntice, this list f cnditins and the fllwing disclaimer. 2. Redistributins in binary frm must reprduce the abve cpyright ntice, this list f cnditins and the fllwing disclaimer in the dcumentatin and/r ther materials prvided with the distributin. 3. All advertising materials mentining features r use f this sftware must display the fllwing acknwledgment: "This prduct includes sftware develped by the OpenSSL Prject fr use in the OpenSSL Tlkit. ( 4. The names "OpenSSL Tlkit" and "OpenSSL Prject" must nt be used t endrse r prmte prducts derived frm this sftware withut prir written permissin. Fr written permissin, please cntact penssl-cre@penssl.rg. 5. Prducts derived frm this sftware may nt be called "OpenSSL" nr may "OpenSSL" appear in their names withut prir written permissin f the OpenSSL Prject. 6. Redistributins f any frm whatsever must retain the fllwing acknwledgment: "This prduct includes sftware develped by the OpenSSL Prject fr use in the OpenSSL Tlkit ( THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 136

137 HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ==================================================================== This prduct includes cryptgraphic sftware written by Eric Yung This prduct includes sftware written by Tim Hudsn Intel License Agreement Cpyright (c) 2000, Intel Crpratin All rights reserved. - Redistributin and use in surce and binary frms, with r withut mdificatin, are permitted prvided that the fllwing cnditins are met: - Redistributins f surce cde must retain the abve cpyright ntice, this list f cnditins and the fllwing disclaimer. - Redistributins in binary frm must reprduce the abve cpyright ntice, this list f cnditins and the fllwing disclaimer in the dcumentatin and/r ther materials prvided with the distributin. - The name f Intel Crpratin may nt be used t endrse r prmte prducts derived frm this sftware withut specific prir written permissin. THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL INTEL OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. Cpyright 2006 Alistair Crks. All rights reserved. Redistributin and use in surce and binary frms, with r withut mdificatin, are permitted prvided that the fllwing cnditins are met: 1. Redistributins f surce cde must retain the abve cpyright ntice, this list f cnditins and the fllwing disclaimer. 137

138 2. Redistributins in binary frm must reprduce the abve cpyright ntice, this list f cnditins and the fllwing disclaimer in the dcumentatin and/r ther materials prvided with the distributin. 3. The name f the authr may nt be used t endrse r prmte prducts derived frm this sftware withut specific prir written permissin. THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. Cpyright (c) , Lïc Hguin <essen@ninenines.eu> Permissin t use, cpy, mdify, and/r distribute this sftware fr any purpse with r withut fee is hereby granted, prvided that the abve cpyright ntice and this permissin ntice appear in all cpies. THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. Cpyright Andrew Thmpsn <andrew@hijacked.us>. All rights reserved. Redistributin and use in surce and binary frms, with r withut mdificatin, are permitted prvided that the fllwing cnditins are met: 1. Redistributins f surce cde must retain the abve cpyright ntice, this list f cnditins and the fllwing disclaimer. 2. Redistributins in binary frm must reprduce the abve cpyright ntice, this list f cnditins and the fllwing disclaimer in the dcumentatin and/r ther materials prvided with the distributin. THIS SOFTWARE IS PROVIDED BY THE PROJECT ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE 138

139 OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. Cpyright (c) Marc Alexander Lehmann Redistributin and use in surce and binary frms, with r withut mdificatin, are permitted prvided that the fllwing cnditins are met: 1. Redistributins f surce cde must retain the abve cpyright ntice, this list f cnditins and the fllwing disclaimer. 2. Redistributins in binary frm must reprduce the abve cpyright ntice, this list f cnditins and the fllwing disclaimer in the dcumentatin and/r ther materials prvided with the distributin. THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE General. This Agreement, including its exhibits (all f which are incrprated herein), are cllectively the Parties cmplete agreement regarding its subject matter, superseding any prir ral r written cmmunicatins. Amendments r changes t this Agreement must be in mutually executed writings t be effective. The Parties agree that, t the extent any Custmer purchase r sales rder cntains terms r cnditins that cnflict with, r supplement, this Agreement, such terms and cnditins shall be vid and have n effect, and the prvisins f this Agreement shall cntrl. Unless therwise expressly set frth in an exhibit that is executed by the Parties, this Agreement shall cntrl in the event f any cnflict with an exhibit. Sectins 2, 3, 5, 7, 8, and 9, and all warranty disclaimers, use restrictins and prvisins relating t Agile s intellectual prperty wnership, shall survive the terminatin r expiratin f this Agreement. The Parties are independent cntractrs fr all purpses under this Agreement Changes t this agreement. Agile will entertain changes t this agreement n a case by case basis. Changes t this Agreement may require that the Custmer pay an additinal administrative fee depending n the scpe and cmplexity f the changes required by the Custmer. The additinal administrative fee, if any, must be paid befre the license will be activated. 139

140 Appendix J Renewing F-Respnse Dngle License Updating the F-Respnse Dngle (FK,CE,CE+C,EE) Purpse This dcument identifies the steps t be taken t update yur F-Respnse USB license key FOB ( FOB ) in the event that yu have upgraded r renewed yur license. What Yu Need In rder t update yur FOB yu will require the fllwing: 1. The f-respnse_<lic#_expdate>.upt2 file yu received frm Custmer Supprt after purchasing yur license renewal r upgrade frm the F-Respnse web site. 2. Yur FOB, f curse. Nte: Upgrades and renewals are tied t a specific FOB, s be certain that yu insert the prper FOB fr use with the prvided upt2 file. 3. A cpy f the latest F-Respnse Updater executable file which is freely available frm the F-Respnse Web site, r installed as part f yur F-Respnse installatin. Step 1 Insert the FOB int an available USB prt n a Windws machine. Step 2 Execute (there is n installatin prcess) the F-Respnse Updater executable file. The fllwing screen appears: Step 3a F-Respnse Updater 140