Hibernation and Forensics

From: Holmes, Ben (Ben.Holmesat_private)
Date: Tue Jun 04 2002 - 18:45:30 PDT

  • Next message: Jean-Luc: "Re: [incident] IIS defacement through FTP, possible DoS"

    Many newer computers and OS's have a "Hibernation" mode or (in the case
    of Laptops mainly), they have a "Save-to-disk" function.
    
    This powers off the system and you can usually remove the hard disk
    drive and image it, however, the image will contain a "snapshot" of the
    system RAM and it should boot into the previous state.
    
    Obviously Network (and dial-up) Connections are broken, however devices
    are restored to their previous state..
    
    After gathering the normal "snapshot" of live information, would putting
    the computer into hibernation (or standby-with-save-to-disk) be better
    than shutting it down?
    
    Also, say you have just gathered the data from an NTFS box, do you shut
    it down nicely (where every program gets an event to terminate, and can
    subsequently "do stuff") or do you just grab that big cord at the back
    and pull (NTFS volumes should survive quite easily).
    
    Does anyone have any thoughts on the usefulness of these procedures?
    
    Is there any "current pseud-standard" to just pull the plug after
    gathering the live data instead of shutting down?
    
    -- Benjamin Holmes
    
    This message is not an official communication of my employer, Getronics.
    
    E&OE. All spelling and grammatical errors are for your enjoyment and
    entertainment only and are copyright Benjamin Holmes.  This message is
    guaranteed free of exotic diseases. This e-mail message and any
    attachments are confidential and may be privileged.  If you are not the
    intended recipient, please notify me immediately by replying to this
    message and please destroy all copies of this message and attachments.
    Please also try to forget everything you have read that was contained in
    this E-Mail message, except this part, and you may not copy it. Thank
    you.  
    
    
    



    This archive was generated by hypermail 2b30 : Wed Jun 05 2002 - 09:49:15 PDT