Should A Computer Be Imaged While Running Or Switched Off

LIVE & OFFLINEACQUISITION · AGUIDEFORUKLAWYERS Should a Computer Be Imaged While Running or Switched Off? Volatile Data, Encryption and the Most Consequential Button in Forensics COMPUTERFORENSICSLAB E - DISCOVERY . U K § ABOUTTHEAUTHOR PRE PA REDBYCOMPUTERFORENSICSLABE - DISCOVERYTEAM CPR PART 35 EXPERT REPORTS FULL CHAIN-OF-CUSTODY DOCUMENTATION § CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the button and its consequences 03 Volatile data: what lives only in memory 04 Encryption changes everything: BitLocker, FileVault and friends 05 Offline (dead-box) acquisition: strengths and risks 06 Live acquisition: strengths and risks 07 The at-the-machine decision framework 08 Servers, sleep states and special cases 09 Recording the decision: NPCC principle 2 in action 10 Worked examples 11 Common mistakes and technical limitations 12 Questions to ask · Suggested wording 13 Checklist and red flags · When to involve a digital forensic expert 14 Frequently asked questions 15 Glossary · References · Disclaimer · How a specialist laboratory can assist § 0 1 · ORIENTATION Executive summary THEHEADLINEPOINT : ASSESSFIRST , CAPTUREMEMORYIFYOUCAN , ANDLET ENCRYPTIONDECIDETHEREST § 0 2 · FIRSTPRINCIPLES The problem in plain English: the button and its consequences § 0 3 · WHATEVAPORATES Volatile data: what lives only in memory § 0 4 · THEGAMECHANGER Encryption changes everything: BitLocker, FileVault and friends § 0 5 · THECLASSICPATH Offline (dead-box) acquisition: strengths and risks § 0 6 · THEMODERNNECESSITY Live acquisition: strengths and risks § 0 7 · THEDECISION The at-the-machine decision framework § 0 8 · BEYONDTHELAPTOP Servers, sleep states and special cases § 0 9 · THEPAPER Recording the decision: NPCC principle 2 in action § 1 0 · INTHEWILD Worked examples EXAMPLE1 · THEPLUGPULLEDONBITLOCKER EXAMPLE2 · THERAMCAPTURETHATHELDTHEKEY EXAMPLE3 · THELIVEACQUISITIONTHATSURVIVEDCHALLENGE § 1 1 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations § 1 2 · INTERROGATORIES & DRAFTINGAIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your eDiscovery / forensic provider SUGGESTEDWORDING · ADDITIONTOTHECLIENTS TA NDSTILLINSTRUCTION SUGGESTEDWORDING · INSTRUCTIONTOTHEEXAMINER AT TENDINGALIVEM AC HINE § 1 3 · QUICKCONTROL Checklist and red flags · When to involve a digital forensic expert The live-or-offline checklist Red flags When to involve a digital forensic expert § 1 4 · COMMONQUESTIONS Frequently asked questions Is it ever right just to pull the plug? the next hour? Does live acquisition contaminate the evidence? The laptop is asleep. Is that on or off? We have the BitLocker recovery key but not the user's password. Is that enough? Should company policy change because of any of this? § 1 5 · REFERENCE Glossary TPM Sources and authoritative references DISCLAIMER § HOWASPECIALISTLABORATORYCANASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY