Differentiating between postmortem and live forensics

- In this video, we'll examine two distinct methods…of digital forensic analysis,…the postmortem and the live analysis.…There are some misconceptions about collection.…One of the fundamental misconceptions…is that pure forensics is the same as physical forensics.…Another misconception is that we always collect everything…at the physical crime scene.…In a physical forensics environment,…we commonly photograph the forensic crime scene…and take reasonable precautions…to ensure the evidence has not been disturbed.…

Let's start off by talking about a postmortem.…Traditionally, computer forensics experts…agreed that shutting down the computer system…in order to preserve evidence…and eliminate the potential of changing information…was the best practice prior to examining.…Postmortem computer forensics…is basically performing a data autopsy on a dead system.…In this case, "dead,"…meaning that that computer's been powered down,…not that the computer's broken.…The focus here is on data recovery…and analysis of stored information…