Subject: Digital Forensics

Topic: Initial response and forensic duplication

Difficulty: Medium

A live response is typically used for two purposes, to gather volatile evidence before a system is shut down for imaging, and as a ‘first look’ at a system to determine whether it requires additional attention.

In large enterprise investigations, you may find that most of your investigation is accomplished …