Advantages And Disadvantages Of Live Acquisition

1740 Words7 Pages
Limitations of Live Acquisition Analysis

Although live acquisition addresses most of the problems associated with dead forensic acquisition, it brings about additional problems:

- Every computer installation is different. Although there are many common components and aspects, computer users can compile their system to their own desire. For this reason, it is the forensic examiner’s job to ensure that s/he has sufficient knowledge of a wide variety of hardware, software and operating systems. It is indeed possible to come across any combination of these components, and the examiner should be prepared to handle all of these. Due to the range of possibilities provided by live forensic analysis, forensic examiners only learn the principles of live acquisition and the effect that specific actions may have on the validity of the evidence. It is
…show more content…
These software tools are focused on every specific type of digital evidence, deleted files, e-mails, network traffic, etc. During the software selection, a choice needs to be made between open source tools or a commercial products. Both of them have their advantages and disadvantages. Factors such as cost, functionality, capabilities, and support are some of the criteria that can be used to make this decision.
One of the more popular open source tool is SIFT, or the SANS Investigative Forensic Toolkit. SIFT Workstation is a powerful, free, open source tool. It is built on the Linux Ubuntu operating system. This tool is capable of file carving as well as analyzing file systems, web history, recycle bin, and even more. It can also analyze network traffic and volatile memory. Furthermore, the tool can be used to generate a timeline, which can be immensely helpful during the investigation process. SIFT supports almost all file
Get Access