Another vote for F-Response. I agree with Eric in that the video, survival guides, and materials they produce are the simplest. Though, if you really need assistance give them a call. They are very good people over there and stand behind their tool!
For scenario 1 - FTK Lite, Have used it and it works well but does leave a small footprint which could be justified in your report.
For Scenario 2 - ?
For scenario 1 - FTK Lite, Have used it and it works well but does leave a small footprint which could be justified in your report.
For Scenario 2 - ?
Every live imaging solution leaves a footprint.
for scenario 2 you could go old school with netcat and dcfldd.
your nerd cred would definitely go up doing it that way!!
Interesting upgrade in the dd with dcfldd , how do i contruct a code that tells dcfldd to image the entire source "capacity" to a target device + MD5 hashing and SHA1.
Thanks.
thats easy
man dcfldd
For scenario 1 - FTK Lite, Have used it and it works well but does leave a small footprint which could be justified in your report.
For Scenario 2 - ?
Every live imaging solution leaves a footprint.
I know that…….;)