ethicalhacker.net — Sometimes your victim cannot afford to remove the system or the only evidence of the incident may currently be in memory. Either way, a standard forensic duplication is impossible. See the 'Live Incident Response Process' in action.