When investigating devices that are powered on and powered off, special consideration must be given to the volatility of data. Booting, rebooting, or shutting down a device can cause data to be written to the hard drive or even lost within RAM and the paging file.
Powered-on versus powered-off device acquisition
by Shiva V.N. Parasram
Digital Forensics with Kali Linux
- Preface
- Introduction to Digital Forensics
- What is digital forensics?
- Digital forensics methodology
- A brief history of digital forensics
- The need for digital forensics as technology advances
- Commercial tools available in the field of digital forensics
- Operating systems and open source tools for digital forensics
- The need for multiple forensics tools in digital investigations
- Anti-forensics: threats to digital forensics
- Summary
- Installing Kali Linux
- Understanding Filesystems and Storage Media
- Incident Response and Data Acquisition
- Evidence Acquisition and Preservation with DC3DD and Guymager
- File Recovery and Data Carving with Foremost, Scalpel, and Bulk Extractor
- Memory Forensics with Volatility
- About the Volatility Framework
- Downloading test images for use with Volatility
- Using Volatility in Kali Linux
- Summary
- Autopsy – The Sleuth Kit
- Network and Internet Capture Analysis with Xplico
- Revealing Evidence Using DFF
Powered-on versus powered-off device acquisition
-
No Comment
..................Content has been hidden....................
You can't read the all page of ebook, please click here login for view all page.