Session 14 - Search & Seizure Live Data Scenarios [First Responder training for Investigators on Cybercrime and Electronic Evidence]

At the end of this session participants will be able to:

• Define the terms “Volatile Data“, “Transient Data“ and “Live Data Forensics“.
• Explain the value of volatile data for investigations.
• List at least four types of data that would get lost without Live Data Forensics.
• Perform measures of first response when facing a running computer system.
• Name at least four tools to acquire volatile data including Live Response and Boot-DVDs.
• Describe the challenges of encryption and the chances of Live Data Forensics in scenarios involving encryption.
• Discuss the challenges and different legal frameworks in scenarios where data is stored remotely, e.g. cloud services.
• Define the term „Cloud Computing“.
• Compare at least three cloud services.