If an incident response analyst has physical access to a potentially compromised system, they have the option of acquiring the memory and other evidence locally. This involves the use of tools run from a USB device or other similar removable medium that is connected to the potentially compromised system. From there, the tools are run and the evidence is collected. Local acquisition is often conducted in conjunction with seizing the hard drive and other evidence from the system. There are several tools that are available for local acquisition. For the purposes of this book, two such tools, Access Data's FTK Imager and WinPmem will be discussed.
When acquiring memory in this fashion, it is advisable to utilize an external ...
