O'Reilly logo

Digital Forensics and Incident Response by Gerard Johansen

Stay ahead with the world's most comprehensive technology and business learning platform.

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, tutorials, and more.

Start Free Trial

No credit card required

Dead imaging

Dead imaging is conducted on media that is not powered on and in the case of hard drives, removed from the potentially compromised system. In terms of evidence preparation, this method is most comprehensive as it allows for the complete preservation and analysis of a physical volume. There are several methods and tools available, both commercial and free-ware that allow for the proper imaging. In addition to software, often times incident response analysts will make use of a hardware write blocker. These devices ensure that no changes are made to the suspect media. As was discussed in Chapter 1, Incident Response, it is critical to be able to demonstrate to a court of law that no changes were made to the original evidence.

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, interactive tutorials, and more.

Start Free Trial

No credit card required