Lesson 7 of 12 · Investigation
Disk and memory imaging: concepts and tools
Objective
Know when and how to acquire a faithful copy of a disk and of RAM so that it is accurate, provable and analyzable without ever altering the original. This lesson gives the concepts and the tools; fine carving practice is a craft of its own.
This lesson is part of the full course
Unlock Linux Incident Response and Digital Forensics to read every lesson, do the exercises, access the simulations and earn your certificate.
Already enrolled? Log in.