Live Forensics vs Plug Pull

paulodicanio · 2007-10-26T17:29:46Z

Im looking for some info or documentation on taking an image of a live running machine vs pulling the plug, removing the HD and using that against a write blocker.1. What will I miss out on potentially by pulling the plug and imaging at a later date?2. By logging in as an administrator and imaging out using FTK to and ext HD how many files am I modifying, I've found quite a few, although this wont amend any docs images etc, which would be core evidence. As well as running FTK Imager from CD / USB, and plugging in my Ext HD for the image.3. If the suspect is currently logged into the network, should I log them out or leave them logged in. For info if they arent admin we wouldnt be able to get an image using FTK lightI'll keep researching in the mean time.

Page 3 / 3 Prev

General (Technical, Procedural, Software, Hardware etc.)

Last Post by DanielleRoberts 18 years ago

21 Posts

7 Users

0 Reactions

3,779 Views

RSS

DanielleRoberts

(@danielleroberts)

Active Member

Joined: 18 years ago

Posts: 9

12/11/2007 7:13 pm

hi H
oh yes i know of your book, it's been spoken of very highly on digital detective. It's on my christmas list!

Thanks for the link, I will have a read of it now.

ReplyQuote

Page 3 / 3 Prev

Android Forensics

I have conducted a logical and partial extraction of a ...

By SgtAndroid , 12 hours ago
Article: The Balance Between Digital Forensic Examiners And Digital Evidence Technicians: Expertise Vs. Efficiency

Can digital forensic labs cut backlogs without cutting ...

By Zoe , 2 days ago
Prefetch Question

Hello All, I have a question regarding Windows prefet...

By Forensic_Tester , 2 days ago

8 Forums
15.7 K Topics
92.3 K Posts
158 Online
41.1 K Members

Forum Icons: Forum contains no unread posts Forum contains unread posts

Topic Icons: Not Replied Replied Active Hot Sticky Unapproved Solved Private Closed