Real Digital Forensics: Live Incident Response - Windows

ethicalhacker.net — Sometimes your victim cannot afford to remove the system or the only evidence of the incident may currently be in memory. Either way, a standard forensic duplication is impossible. See the 'Live Incident Response Process' in action. Jul 19, 2006 View in Crawl 4