I'm taking a study course on CCSP and am going over a section on the digital forensics investigation process. In particular, the instructor discussed the following:
I'm curious on two bullet points here:
- Capture an accurate image of the system.
- Work from volatile to persistent evidence.
Both of those make sense by themselves but I'm wondering if/how it's possible to capture an image of a system INCLUDING volatile evidence.
Wouldn't I have to shut the system down (or reboot) in order to collect an image? If so, wouldn't I lose a large chunk of volatile information (e.g. running processes, memory, etc)?
From a practical perspective, how can volatile evidence be preserved?