Post-Mortem RAM Forensics - CanSecWest
Post-Mortem RAM Forensics - CanSecWest
Post-Mortem RAM Forensics - CanSecWest
SHOW LESS
You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
<strong>CanSecWest</strong>2007<br />
13<br />
Impact<br />
• If a first responder arrived on<br />
scene and a computer is powered<br />
off, is it considered ‘good practice’<br />
to turn it on?<br />
– Why not?<br />
– Last booted times, file access times,<br />
pagefile, boot time run options<br />
– If it is preferred to not ‘touch’ the disk,<br />
why ‘touch’ <strong>RAM</strong>?<br />
– Lets start moving up the order of<br />
volatility chart<br />
VIDAS
Change language