Digital Forensics and Incident Response - Second Edition

Local acquisition

If an incident response analyst has physical access to a potentially compromised system, they have the option of acquiring the memory and other evidence locally. This involves the use of tools that are run from a USB device or a similar removable medium that is connected to the potentially compromised system. From there, the tools are run and the evidence is collected. Local acquisition is often conducted in conjunction with seizing the hard drive and other evidence from the system. There are several tools that are available for local acquisition. For the purposes of this book, three such tools – Access Data's FTK Imager, Google's WinPmem, and Belkasoft's RamCapturer – will be discussed.

When acquiring memory in this fashion, ...