CHFI (312-49) Digital Forensics Simulation
Investigation Scenario
During an incident response engagement at a defense contractor in Virginia, an alert triggers for suspicious outbound traffic originating from a senior engineer's workstation. The physical security team immediately secures the room. Upon your arrival as the lead forensic investigator, you find the workstation powered on with the screen locked. Network monitoring logs show an ongoing, active TCP connection to an unknown external IP address. The IT department confirms that all company workstations enforce hardware-backed Full Disk Encryption (FDE).
Evidence Collected
Preliminary scene assessment yields the following system conditions:
Note: If power is cut to the machine, the TPM will clear the BitLocker keys from RAM, and all active network socket information will be destroyed.
Question
When is "Live Forensics" preferred over traditional dead forensics?
Expert Analysis
- What evidence shows: The system is running, full disk encryption is actively unlocked, and there is a live network connection exporting data. This means the decryption keys and the malware process tree exist strictly in volatile memory.
- Identify forensic stage: Preservation and Collection.
- Why correct answer is correct: Live forensics is mandatory when a system is powered on and contains critical ephemeral data that would be destroyed upon shutdown. This includes Full Disk Encryption (FDE) keys, active network sockets, running processes, and clipboard contents. If you perform a traditional "pull-the-plug" dead acquisition here, the hard drive will lock, and the data will be inaccessible.
- Why others are wrong:
- Physical damage (B): Requires specialized hardware recovery in a clean room, which is independent of the live/dead decision.
- Unlimited time (C): Time constraints do not dictate the forensic methodology; the volatility of the evidence dictates the methodology.
- Powered off for a long time (D): If a system is powered off, live forensics is impossible. You must perform traditional dead forensics (static acquisition).
- Real-world forensic action: The investigator must prioritize RAM acquisition. They will insert a forensically sterile USB drive, execute a memory capture tool (e.g., Belkasoft RAM Capturer, FTK Imager, or Magnet RAM Capture) with elevated privileges, and dump the 32GB of physical memory to a raw file. Only after the RAM is secured can the investigator consider capturing logical disk images or safely shutting down the machine.
MINI LESSON: Live vs. Dead Forensics
The forensic paradigm shifted heavily with the widespread adoption of Full Disk Encryption (BitLocker, FileVault, LUKS).
- Dead Forensics (Static Acquisition): The traditional approach. Power is removed from the system, the storage drive is removed, connected to a hardware write-blocker, and a bit-for-bit image (E01/DD) is created. Used primarily when the system is already off or encryption is not a factor.
- Live Forensics: Analyzing and acquiring data from a running system. It is inherently more risky because interacting with the system changes its state (violating strict preservation). However, it is an absolute necessity to capture volatile memory (RAM) where encryption keys and active malware reside. The accepted rule is to document all changes made during the live collection process.