11 CAPTURING A MOVING TARGET
The nature of many security incidents, and the digital forensics investigations that are associated with them, often places a first responder in a challenging position. There are frequently factors that force our hand and require the first responder to interact directly with a system containing potential evidence. This situation runs contrary to the fundamental forensic principle that actions taken by the digital forensics professional should not alter or affect the data stored on the suspect machine. It is impossible to use any sort of live capture tool without having some sort of impact on a machine. It is, however, possible to do so in such a way that the first responder is fully aware of the impacts of doing ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access