Video Transcription

00:00
all right, Welcome to advanced ever Met Tree forensic acquisition. We'll talk about allocated nonlinear, partial and live images today.
00:11
All right, so in summary, today's video our course we learned howto make an ever men tree allocated on Lee forensic image where we just collected the actual operating system and files on the system and not that blank space we learned howto
00:28
Macon ever met tree nonlinear, partial forensic image. Or, as I like to call it, a file type image. We also learned howto
00:35
edit our file type choices there so we could make our own custom, uh, file type queries. We looked at how to make a elementary live friend disk image of a Windows target system. We also, you know, talked the way through the, you know, how would be slightly different on a on A Mac or or Lennix system.
00:53
And then we looked at it. Ah, you know the downloadable, um,
00:56
push and pull pulling push. If you prefer elementary live agents, how you might get those onto various computers and collect across the network
01:06
in a network environment where that's a more convenient situation
01:11
and, ah, before a run and move on to the next course. As always, feel free to email me if you have questions or didn't quite understand something and, you know, get your friends stuff together and come run with us.

Advanced Evimetry Forensic Acquisition: Allocated, Non-Linear Partial, and Live Images

This free course covers advanced forms of disk imaging that can be invaluable in cases where acquiring large amounts of unused disk space is not ideal, and where only certain file types are needed when you need to collect data from a live system.

Instructed By

Instructor Profile Image
Brian Dykstra
CEO and President of Atlantic Data Forensics
Instructor