On 23 Oct 2001, at 6:18, H C wrote: > conducting 'live' forensics investigations on NT/2K (and > ultimately XP). I would say you first need to separate systems which are prepared for this kind of investigation and systems which are not ;-) Starting with NT 5.0 (= W2K), there is the *very* helpful hibernation option. It will just copy the entire RAM onto a file at the HD :-)) I am not sure at the moment, but I think even when this option is not enabled, you can enable it without rebooting and save the current state to disk. With NT 3.x and NT 4, there is no such option. Frank Heyne ----------------------------------------------------------------- This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com
This archive was generated by hypermail 2b30 : Wed Oct 24 2001 - 17:37:36 PDT