Some said Live View could only boot up images acquired from 32bit OS evidence. I have to say that it's not true. Ok, the best way to prove it is let the evidence speak for itself~
I've been using Live View for Live Forensics for so many years. You guys could take a look at my blog as below. I use Live View to boot up 64bit Windows and Linux successfully.
http//
I think the reason why some forensic guys "believe" that Live View could not boot evidence successfully are as below
1.They forgot mounting tools(ex FTK Imager) requires Administrator privileges to run.
2.They forgot Live View requires Administrator privileges to run.
3.Whenever they saw any terrible word(ike "error","warning","failed") in the Live View message boxs, they will shut Live View down immediately without hesitate. Acutally they should be more patient, let Live View to parse and analyze those partitions. When completed they could use VMWare to open the snapshot and see if it works or not. Remember one very important thing "Don't jump to conclusions too soon"…some forensics should get rid of such kind of bad habit…
Some said …
WHO?
WHERE?
WHEN?
For no apparent reason 😯 stig-ism
https://
jaclaz