Forensic Acquisition and Triage

Forensics acquisition, also known as Forensics imaging or data acquisition, is the process of creating an exact duplicate (or "image") of data from a specific storage device or media for the purpose of preserving the original data for legal or investigative purposes. The image can then be analyzed and examined for evidence without altering the original data. This process is used in criminal investigations, civil litigation, and computer security incident investigations to gather and preserve digital evidence.

1. 1Lessons7 lessons

   1. 1.1Introduction to Forensics Acquisition and TriagePreview5 min
   2. 1.2Acquiring Memory Image From Windows and Linux6 min
   3. 1.3Custom Image Using FTK and Mounting Image for Analysis6 min
   4. 1.4KAPE Targets for Acquisition3 questions · 8 min
   5. 1.5KAPE Modules for Triage and Analysis5 min
   6. 1.6Triage Using FireEye Redline7 min
   7. 1.7Acquisition and Triage of Disks Using Autopsy5 min