Categories: White Papers
      Date: May 19, 2011
     Title: Build Context into Your Digital Forensic Exam with Online Evidence
“dead” forensics – and even “live” forensics – only capture part of the story of a
suspect's activities. Artifacts related to the Internet, social networking sites, online searches,
and webmail uncover what the suspect did at just a specific point in time, while live forensics
capture what's occurring in the computer's memory (but not on the suspect's online sites)
while it is running.
To get a full picture, online evidence is necessary. In fact, the documentation of internet-based
evidence is the logical extension of digital forensic examinations.

“Dead” forensics – and even “live” forensics – only capture part of the story of a suspect's activities. Artifacts related to the Internet, social networking sites, online searches, and webmail uncover what the suspect did at just a specific point in time, while live forensics capture what's occurring in the computer's memory (but not on the suspect's online sites) while it is running. To get a full picture, online evidence is necessary. In fact, the documentation of internet-based evidence is the logical extension of digital forensic examinations.



Download "Build Context into Your Digital Forensic Exam with Online Evidence"