Page 1
LIVE & OFFLINEACQUISITION · A GUIDE FOR UK LAWYERS Should a Computer Be Imaged While Running or Switched Off? Volatile Data, Encryption and the Most Consequential Button in Forensics COMPUTER FORENSICS LAB E-DISCOVERY. UK
§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM CPR PART 35 EXPERT REPORT S FULL CHAIN-OF-CUSTODY DOCUMENTATION
§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the button and its consequences 03 Volatile data: what lives only in memory 04 Encryption changes everything: Bit Locker, File Vault and friends 05 Offline (dead-box) acquisition: strengths and risks 06 Live acquisition: strengths and risks 07 The at-the-machine decision framework 08 Servers, sleep states and special cases 09 Recording the decision: NPCC principle 2 in action 10 Worked examples 11 Common mistakes and technical limitations 12 Questions to ask · Suggested wording 13 Checklist and red flags · When to involve a digital forensic expert 14 Frequently asked questions 15 Glossary · References · Disclaimer · How a specialist laboratory can assist
§ 01 · ORIENTATION Executive summary THE HEADLINE POINT: ASSESSFIRST, CAPTURE MEMORY IF YOU CAN, ANDLET ENCRYPTIONDECIDETHEREST
§ 02 · FIRST PRINCIPLES The problem in plain English: the button and its consequences
§ 03 · WHATEVAPORATES Volatile data: what lives only in memory
Page 2
§ 04 · THEGAMECHANGER Encryption changes everything: Bit Locker, File Vault and friends
§ 05 · THECLASSICPATH Offline (dead-box) acquisition: strengths and risks
§ 06 · THEMODERNNECESSITY Live acquisition: strengths and risks
§ 07 · THEDECISION The at-the-machine decision framework
§ 08 · BEYONDTHELAPTOP Servers, sleep states and special cases
§ 09 · THE PAPER Recording the decision: NPCC principle 2 in action
Page 3
§ 10 · IN THE WILD Worked examples EXAMPLE1 · THEPLUGPULLEDONBITLOCKER EXAMPLE2 · THERAMCAPTURETHATHELDTHEKEY EXAMPLE3 · THELIVEACQUISITIONTHATSURVIVEDCHALLENGE
§ 11 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations
§ 12 · INTERROGATORIES & DRAFTING AIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your e Discovery / forensic provider SUGGESTED WORDING · ADDITIONTOTHECLIENTS TA NDSTILLINSTRUCTION SUGGESTED WORDING · INSTRUCTION TO THE EXAMINER AT TENDINGALIVEM AC HINE
§ 13 · QUICK CONTROL Checklist and red flags · When to involve a digital forensic expert The live-or-offline checklist Red flags When to involve a digital forensic expert
§ 14 · COMMON QUESTIONS Frequently asked questions Is it ever right just to pull the plug? the next hour? Does live acquisition contaminate the evidence? The laptop is asleep. Is that on or off? We have the Bit Locker recovery key but not the user's password. Is that enough? Should company policy change because of any of this?
§ 15 · REFERENCE Glossary TPM Sources and authoritative references DISCLAIMER
Page 4
§ HOW A SPECIALIST LABORATORY CAN ASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY
Cite as: Joseph Naghdi, Should A Computer Be Imaged While Running Or Switched Off, Computer Forensics Lab, https://e-discovery.uk/library/should-a-computer-be-imaged-while-running-or-switched-off/pdf.