It was March 2, 2013, when the first version of FAW was released, the first version of the program already had what it takes to run forensic acquisitions of Web pages in a simple, automatic and error-free way.
Unlike solutions such as Web Archive, Archive.is or Hashbot, FAW can also securely capture credential-protected pages such as Webmail or Facebook profiles including photo chat galleries and allow them to be verified by third parties or to be used in court as evidence in either criminal or civil proceedings.
FAW was developed by two Italian Bassani and Zavattari and is ideal for law enforcement officers, investigators, notaries, attorneys, technical consultants, CTP, CTU or even for private individuals who need to obtain web pages to be produced in criminal or civil proceedings.
The usefulness of this product is undeniable. Suffice it to consider the constant increase in the number of crimes on the Web: defamation, copyright, stalking, pedophilia, p2p, privacy, and more.
The reports by David Tanzer, Diego Febbraio, Stefano Comparetti, Joanne Tan, Litiano Piccin, Yohann Lepage, Paolo Dal Checco and many other computer forensics-leading figures have allowed the product to evolve with new features.
FAW is also celebrated by the Forensics Insight community in Korea, where JK Kim presents the software at the Trends in dForensics conference.
In May 2013, the second major release of the software was presented; in this new version it is very interesting the new acquisition verification algorithm.
It contains a control code that allows you to verify that the capture has not been maliciously altered.
Davide Gabrini and Mattia Epifani mentioned the product during their conferences at several Italian Universities.
A further appreciation came from overseas with the 5 stars attributed by the authoritative English magazine Digital Forensics Magazine that has written 3 full pages with a thorough review of the same.
In January 2014, version 2.1 is released, with the main features being the capture of all the objects automatically linked to the web page. You can capture all kinds of files including: images, archives, documents, executables, and scripts.
In March 2014, FAW integrates with wireshark and thus acquires all the network traffic generated during the Web site acquisition activity.
FAW also receives a lot of interest from the USA, from where an authoritative publication was written by Nicholas Aspinwall of the CHAMPLAIN COLLEGE – Senator Patrick Leahy – Center for Digital Investigation.
FAW IN TOUR
On 24 June 2014, at the congress center Villa Cagnola in Gazzada, there was a free seminar on the topic “THE FORECAST ACQUISITION OF WEB PAGES – THE WEB PAGE AS A DIGITAL TEST”.
The seminar was attended by all legal practitioners (law enforcement officers, lawyers, magistrates, notaries, experts and technical advisors) who need to acquire web pages as substantial evidence for criminal and civil proceedings.
Here, all FAW features for web page capture were displayed and there was an active interaction with the audience that showed high interest in them and asked developers for new features. In particular, the Notary Ugo Becchini is grateful for the valuable advice and reflections on the use of this software in the notary office.
The most important feature of the new release is certainly the integration with VLC to record PC shots during web page capture operations. In this FAW is able to acquire and certify the screencast executed.
The Polish police chose FAW as the first forensic tool to acquire digital evidence for trial purposes. Developers thank Arek Czak for their valuable tips.
In October 2014, a FAW review was written by Eng. Consalvo, an authoritative figure of the Italian computer forensics.
He unequivocally defines the product as the jewel in the crown of Italian engineering by literally quoting: “Currently, FAW is the only application capable of offering a number of forensic utilities that can enrich the business of acquiring a web resource, It is possible to capture and “crystallize” a chat conversation, for example, via facebook, by having access credentials, and accessing a web page accessible through the https protocol. ”
In November 2014, the authors confirmed the expectations and rumors that had appeared on the major newspapers and computer forensics portals in previous days.
Of course, the novelty of Version 4 is the ability to save capture data to a remote server and validate it from the same server.
This feature provides technical consultants with an additional tool to verify the integrity of the acquisitions.
“The interest in this latest version of the software is also demonstrated by the high number of downloads – more than 1000 – executed in the first 24 hours of its release,” the developers say, “the testimony that the road is the right one.”
FAW, in its latest release, 5.x released in April 2017, introduced new important features and remarkable performance improvements thanks to the innumerable feedbacks received from the Italian and international forensic community; First of all the multilingual management of the software; All ISO 8601 timestamps were then entered, including time zone references; A viewer/editor was added to the hosts file to make changes easily and quickly; Cache deletion management that can be customized by the user has been improved; The screencast, which is now recorded in mp4 h264 at 25f / s, has been improved; hash calculation with the SHA-256 algorithm has now been added.
In January 2017 an article appeared on “IISFA Memberbook 2016 – DIGITAL FORENSIC” explaining the operation and benefits of FAW version 5.0.
FAW AND VIRTUAL BOX
Latest developer news is FAW on VirtualBox that allows you to use the software on Windows, Mac OS X and Linux platforms using the ready-made and downloadable virtual machine from the download area with all the necessary for forensic acquisition of web pages.
In the virtual machine the following software have already been installed: FAW, VLC and Wireshark; FAW is already configured and ready to be used in standard configuration for the capture of audio / video and generated network traffic.
FAW on VirtualBox guarantees a clean, certified, and free of any vulnerability environment to malicious software. The virtual machine can be cloned at each acquisition and thus ensure the use of a regenerated environment at every use.
New features are launched With 6.0 FAW version to improve the performances and to make the use easier; sure enough, from this version, You have not to install the VLC software to capture the PC’s screen because FAW integrates already all it needs to run high quality screencast, capturing the 30f/s video and 48KHz audio.
The most awaited innovation of the version 6 is certainly the use of it like browser to surfing on the web and to capture websites by Chromium component developers. With this new component, FAW is able to capture all type of websites, even that Microsoft browser did not support in the past.
From this version is possible to capture the web site WhatsApp Web and the web sites with Flash videos. It is possible to capture automatically iFrames code of the pages too and capture pictures with parameters in URL address.
IISFA SEMINAR WITH FAW
In September 2017 at the University of Milan FAW developers presented in advance the important innovations of the version 7 FAW.
FAW 7 – released on 3rd of october 2017 – is an absolute innovation, infact in addition to the classic software there are 7 new tools allow new, more safe and automatic type of acquisition. FAW 7 sure enough is a Suite of forensic instruments useful for acquisition of all type of web pages, web sites and other resources. With version 7 You have available the follow instruments:
- FAW TOR, for web pages acquisition in Darkweb with TOR network;
- FAW STOP allows to start and stop manually web pages acquisition, it allows to the operator capture the behavior of pages and multimedial contents (audio/video);
- FAW TIME allows to plan web page acquisition to capture its content in different parts of the day;
- FAW BOT is a really crawler searches all the web pages relate to the main pages, extracting URL and height to create an index from whom You can do the successive automatic acquisitions. It also allows to do research in web sites with login protect areas, for example social networks;
- FAW MULTI is the multi pages FAW version and it allows the automatic capture of a list of web pages. It is suitable to fast and automatic capture full web sites;
- FAW FTP with this instrument You can capture full websites with FTP mode without edit copied files meta datas;
- FAW REPORT allows create a detailed report of all doing activities with FAW suite, used a full custom tamplate.
In addition of this new seven tools, FAW added new and interesting features asked by technical consultants for example:
- Acquisition of SSL/TLS server and client certificates; acquisizione dei certificati SSL/TLS server e client;
- script injection in web pages (bookmarklet);
- manually setting of referral.