Practical Windows Forensics

Acquisition

As we discussed before, the best practice is to start the evidence acquisition before changing anything in the machine under investigation. The acquired evidence must be stored in the USB storage device or network share. In our case, a USB storage device can be used between the infected and the analysis machines, but it must be carefully wiped after the analysis. Network acquisition with another analysis Linux virtual machine over the virtual network will be efficient in our case as well. Network acquisition will be as discussed before in Chapter 4, Nonvolatile Data Acquisition. We need to acquire the memory and hard disk of the infected machine.

Exercise: You need to perform this step, as we discussed before in the acquisition sections ...