Live Forensic Analysis, Essay Example

Advanced Digital Forensics

Discussion will highlight overview and comparison between live forensic analysis and converting a bit image copy from a standalone system. Moreover, advantages related to live forensic analysis will also be highlighted. In a process of writing bit stream data to files, forensic investigators are facilitated by robust data transfers, inadequate and small data transfer errors can be ignored and raw data can be easily visible. On the other hand, there are some negative aspects. For instance, if the suspect has a 400 gigabyte hard drive, forensic investigator must attach the hard drive of the same size or greater, in order to create disk image. Moreover, if hard drive has a bad sector, tools cannot help in this regards and the data from that cluster will be skipped. In the context of live investigation, Encase is a worldwide recognized tool that is only operational on love investigation platforms. Encase will facilitate by parallel text searching methods, regular expression, grep and hex.  Moreover, carving method is automated as well as manual. Scripts contribute carving for easy operations. It also produces compress and uncompressed image files and there is no limitation in size for storing disk to image files.  Likewise, allow space in segmented files for incorporating metadata In terms of creating reports, Encase produces massive reports that are difficult and time consuming to customize. Furthermore, encase crashes on damaged or corrupt image files (Bunting, 2008). In my opinion, Encase is recommended, as it contains many features that makes management of forensic investigation an easy tasks.

References

Bunting, S. (2008). EnCase computer forensics: The official EnCE: EnCase certified examiner study guide . Indianapolis, Ind.: Wiley Pub.