Some examples of information that might be stored in ram include: You can imagine how much evidence the RAM may contain. As soon as the power is turned off, all information stored in RAM is lost.Īll programs running on your system are storing data in RAM. One of the downsides of RAM, however, is that it requires power to keep the data accessible. The Random access memory or RAM is a form of computer data storage that allows information to be stored and retrieved on a computer. Because information is accessed randomly instead of sequentially like it is on a hard drive, the computer can access the data much faster. For now, we will focus on why you might want to image the RAM and how to do this with FTK-Imager.
How to handle a live system is something I will discuss in a separate post. However, what if you encounter a live system? During an investigation, you always want to create a forensic image of all the relevant computer systems.
0 kommentar(er)
