3 ms·
Why dump memory when you can do this instead: http://www.youtube.com/watch?v=erq4TO_a3z8 http://www.youtube.com/watch?v=erq4TO_a3z8
by X-Istence 15y ago
Why dump memory when you can do this instead:
http://www.youtube.com/watch?v=erq4TO_a3z8 http://www.youtube.com/watch?v=erq4TO_a3z8
- trotsky 15y agoFor chain of custody etc. you always need to make a master copy and sign/hash it and then work off of a copy. If you tried to do forensics on the actual computer as seized you'd be busy destroying disk & memory evidence as you worked.
- X-Istence 15y agoThat is fine for working on it (and having taken computer forensics classes at college something I am intimately familiar with), however it no longer needs to be done on location. The device can safely be removed without requiring a tech to go out to the location.