Once a proper repository is configured for the image file, the incident response analyst is ready to perform the sequence to acquire the necessary evidence. In this chapter, three separate sequences are discussed. Two will be powered-off systems and one will examine the sequence for capturing a live image. The analyst should select the appropriate technique based upon the incident investigation. In any incident, no matter what technique is utilized, the incident response analyst should be prepared to properly document their actions for any subsequent forensic report.
Dead imaging is conducted on media that is not powered on and in the case of hard drives, removed from the potentially compromised system. In terms of evidence preparation, this method is most comprehensive as it allows for the complete preservation and analysis of a physical volume. There are several methods and tools available, both commercial and free-ware that allow for the proper imaging. In addition...