Honestly, I cannot fathom the purpose of this exercise.
Shouldn't we be able to say whether a tool creates files or registry entries or what its memory footprint is before we use it on a live system? It's pretty obvious that preserving memory is better than not preserving it. Even if the imaging tool has an inordinately large footprint, we're saving far more evidence than if we just pulled the plug. But that won't stop an attorney from asking questions or suggesting that maybe there was something critical that we carelessly erased.
Honestly, I cannot fathom the purpose of this exercise.
Shouldn't we be able to say whether a tool creates files or registry entries or what its memory footprint is before we use it on a live system? It's pretty obvious that preserving memory is better than not preserving it. Even if the imaging tool has an inordinately large footprint, we're saving far more evidence than if we just pulled the plug. But that won't stop an attorney from asking questions or suggesting that maybe there was something critical that we carelessly erased.
Maybe the comment by keydet89 was more about the "strict nature" of the exercise, I mean we do have a "general catalog" of tools here
http//
The issue might IMHO be if - besides the amount of memory the tool "eats up" for running - there are other aspects that should be taken into account in a "comparative review".
Just as an example, on the page for one of the free tools mentioned in the above, the Belkasoft RAM Capturer
http//
it is stated how a couple other freely available tools failed to properly image fully the RAM in some specific "protected" environments.
And there is similarly oriented literature on the topic
http//
In theory "tool A" may seem "better" than "tool B" because it "eats up" less memory when running, in practice it is possible that "tool A" fails to acquire properly large chunks of memory.
So the "metrics" of the assignment may be "too narrow" or "misleading" and a more comprehensive review/comparison should be made.
Now, would such an evaluation be at a level a student can reach ("left alone", i.e. without continuous assistance/feedback loop from the instructor as in the case - as it seems - of a "homework")?
Also, which might be the "side effects" or "collateral damages" of "tool A" (let's say requiring installation and/or a number of writes to the Registry) vs. "tool B" (let's say non-fancy .Net stuff, plain executable that can simply be run from command line)?
jaclaz