Timeline for What's a practical example of how volatile information can be preserved in a digital forensics investigation?
Current License: CC BY-SA 3.0
7 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Mar 8, 2018 at 11:29 | history | edited | jas- | CC BY-SA 3.0 |
added 279 characters in body
|
| Mar 7, 2018 at 16:34 | comment | added | jas- |
You can use tools such as mdb or gdb to examine a core dump that was generated prior to a full disk backup
|
|
| Mar 7, 2018 at 16:26 | comment | added | Tom K. | This basically comes down to your understanding of the word "image" and how an image of a machine can be created. An image can be the state of a live machine and there are various techniques on how to obtain such an image (like snapshotting but more sophisticated). | |
| Mar 7, 2018 at 16:13 | history | edited | jas- | CC BY-SA 3.0 |
added 8 characters in body
|
| Mar 7, 2018 at 16:03 | comment | added | jas- |
Most will bind it using nc and obtain it remotely
|
|
| Mar 7, 2018 at 16:00 | comment | added | Mike B | Thanks but I'm still confused. Wouldn't I need to save the memory/core dump somewhere locally? And in so doing, wouldn't that effectively be tampering with the local storage of the system in question? | |
| Mar 7, 2018 at 15:58 | history | answered | jas- | CC BY-SA 3.0 |