Subject: Digital Forensics

Topic: Initial Response and forensic duplication

Difficulty: Medium

Potentially, a live collection may answer the majority of questions you may have during the initial stages of an investigation. It depends on the level of detail that you collect during a live response.

A small collection consisting of

• users,

• processes,

• select registry keys, and

• network …