Sign in to track your courses and achievements.
Sign in to OcsalyLearn
Achievements
Capture The Flag
Live vs Post-Mortem Acquisition
COURSE LESSON
Continue your learning
Sign in to access your enrolled courses, or view the course details before enrolling.
Sign in View courseLearn when to choose live data collection (RAM, network sessions, volatile logs) versus post-mortem acquisition (disk images, registry dumps, deleted files). Understand the legal, technical, and situational trade-offs of each method.
Key topics:
-
When to image live vs dead systems
-
Risks of changing volatile evidence
-
Tools used for live memory capture
-
Using hashes and documentation for validation
-
Preserving chain of custody in both scenarios