Video Description

This lesson covers volatile data considerations. The decision to shut down a system is made on a case by case basis and the collection of volatile data requires changes to a system which could overwrite more valuable data. An investigators work might be hindered by computer inactivity such as power schemes, screen savers and hibernation. It is also important to remember that with an active connection, an investigator does not have total control of the system. If it is necessary to terminate connections, be sure to determine if it is wireless or wired as those have specific instructions.

Course Modules

Incident Response & Advanced Forensics