Live Forensics vs Plug Pull

paulodicanio · 2007-10-26T17:29:46Z

Im looking for some info or documentation on taking an image of a live running machine vs pulling the plug, removing the HD and using that against a write blocker.1. What will I miss out on potentially by pulling the plug and imaging at a later date?2. By logging in as an administrator and imaging out using FTK to and ext HD how many files am I modifying, I've found quite a few, although this wont amend any docs images etc, which would be core evidence. As well as running FTK Imager from CD / USB, and plugging in my Ext HD for the image.3. If the suspect is currently logged into the network, should I log them out or leave them logged in. For info if they arent admin we wouldnt be able to get an image using FTK lightI'll keep researching in the mean time.