Post-Mortem RAM Forensics - CanSecWest

CanSecWest2007
12
The case for copying
• Even though it is known that
creating the copy changes the
state (ie. creates a new process)
• It creates less impact than
interacting with the machine in
order to gain insight as to the the
current state
VIDAS