Chapter 2
Malware Incident Response: Volatile Data Collection and Examination on a Live Linux System
Solutions in this chapter:
Volatile Data Collection Methodology
Non-Volatile Data Collection from a Live Linux System
Introduction
Just as there is a time for surgery rather than an autopsy, there is a need for live forensic inspection of a potentially compromised computer rather than an in-depth examination of a forensic duplicate of the disk. Preserving data from a live system is often necessary to ascertain whether it has malicious code installed, ...
Get Malware Forensics now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.
