Safer Live Forensic Acquisition

Computer forensic practitioners must gather, analyse and present evidence at court. A method of data gathering called live forensic acquisition is often used. This method involves gathering data from a system without shutting it down and allows forensic practitioners to access a large quantity of valuable information. However, as data on the computer is constantly changing the copy of data taken is slurred. Slurred data is difficult to analyse as different pieces of the data show the system at different times and these times are unknown. This project identifies the weaknesses with the current live forensic methodology and provides an improved method which produces perfect, unslurred, images. This greatly improves the analytical value and evidential integrity of the data.