Can Live View boot ...
 
Notifications
Clear all

Can Live View boot up images acquired from 64bit evidence?

2 Posts
2 Users
0 Reactions
577 Views
(@gorvq7222)
Reputable Member
Joined: 11 years ago
Posts: 236
Topic starter  

Some said Live View could only boot up images acquired from 32bit OS evidence. I have to say that it's not true. Ok, the best way to prove it is let the evidence speak for itself~

I've been using Live View for Live Forensics for so many years. You guys could take a look at my blog as below. I use Live View to boot up 64bit Windows and Linux successfully.
http//www.cnblogs.com/pieces0310/p/4677987.html

I think the reason why some forensic guys "believe" that Live View could not boot evidence successfully are as below

1.They forgot mounting tools(ex FTK Imager) requires Administrator privileges to run.

2.They forgot Live View requires Administrator privileges to run.

3.Whenever they saw any terrible word(ike "error","warning","failed") in the Live View message boxs, they will shut Live View down immediately without hesitate. Acutally they should be more patient, let Live View to parse and analyze those partitions. When completed they could use VMWare to open the snapshot and see if it works or not. Remember one very important thing "Don't jump to conclusions too soon"…some forensics should get rid of such kind of bad habit…


   
Quote
jaclaz
(@jaclaz)
Illustrious Member
Joined: 18 years ago
Posts: 5133
 

Some said …

WHO?
WHERE?
WHEN?

For no apparent reason 😯 stig-ism
https://motortorque.org/articles/some-say-stig-isms-the-complete-stig-introductions

jaclaz


   
ReplyQuote
Share: