Live & Remote Forensics

A search of this site will bring up a great deal of discussion on the topic, one or two experts, several books and a list of tools …

( For example http//www.forensicfocus.com/index.php?name=Forums&file=viewtopic&t=1638 http//www.forensicfocus.com/index.php?name=Forums&file=viewtopic&t=1800 for example )

Might I suggest that you start with that ?

hi Azreal

thanks for the link iv already been through that. is there any other info that may help?

Well, in which case, books - Harlan Carvey's are good …

Have a look at Helix - that has live capture, and that is discussed in the manual.

Websites … Harlan's blog - http//windowsir.blogspot.com/2005/09/remote-forensics-system.html - has a fair bit on live forensics.

There are some other tools, who's names escape me just now … ( Sorry, was an early start today … ) Google should bring them up if you search a bit …

thanks for the link iv already been through that. is there any other info that may help?

http//www.4tphi.net/fatkit/
https://www.volatilesystems.com/

Both sites belong to AAron Walters, and I would consider AAron to be at the cutting edge of live forensics. The first URL provides a concise list of other very pertinent resources. The second URL contains details of AAron's latest project. Volatility which is an open source forensic analysis tool for memory analysis.