Bootup Win10 64bit ...
 
Notifications
Clear all

Bootup Win10 64bit E01 by using LiveView 0.8 RC1

1 Posts
1 Users
0 Reactions
1,018 Views
(@gorvq7222)
Reputable Member
Joined: 11 years ago
Posts: 236
Topic starter  

The latest Windows 10 will be more and more popular in the very near future. Now let's take a look if we could conduct a live forensic on Win10 by using LiveView 0.8 RC1.
You guys could take a look at my blog to see the screenshots I took
http//www.cnblogs.com/pieces0310/p/5374502.html

1.The OS version of suspect's laptop is Windows 10. After acquiring we got the E01 evidence files. First we could use FTK Imager Lite to mount these E01.
2. Run LiveView 0.8 RC1 to create snapshot from emulated disk.
3. Fortunately it boots up and we could see suspect's Windows 10 64bit is alive.

Now we could conduct live forensics to see what's going on about this case.


   
Quote
Share: