Live Response
Definition
The process of collecting evidence and triage data from a running system without first powering it down. Preserves volatile artefacts that would be lost in a traditional dead-box acquisition but introduces contamination risk through the act of collection itself.
Related terms
- Order of Volatility
- The sequence in which digital evidence should be collected, ranked from most to least transient. Defined in RFC 3227. CPU registers and...
- ARP Cache
- A table held in memory that maps IP addresses to hardware (MAC) addresses for recently contacted hosts on the local network. ARP...
- Chain of Custody
- The documented chronological record of who collected, handled, transferred, and examined a piece of evidence. For digital evidence, chain of custody includes...
- DNS Resolver Cache
- A temporary store of DNS query results held by the operating system. Entries reveal which domain names a host has recently resolved,...
- Faraday Bag
- A signal-blocking pouch with conductive mesh lining that prevents cellular, Wi-Fi, Bluetooth and NFC signals from reaching a seized phone. The standard...
- Forensic Image
- A bit-for-bit verified copy of a storage medium, created using a write-blocker to prevent modification of the original. The copy is verified...
- Hash Verification
- The process of computing a cryptographic hash (SHA-256 or equivalent) of the exhibit file and comparing it against a previously recorded value...
- Memory-Resident Malware
- Malicious code that executes entirely in RAM and writes no files to disk. Fileless malware, PowerShell-based loaders, and certain rootkits fall into...
- Non-Volatile Data
- Data that persists without power, such as files on a hard disk, SSD, or optical media, and data in non-volatile memory chips....
- Process Tree
- A structured representation of running processes showing each process alongside its parent. Malware frequently spawns command shells or other processes from unexpected...
- RFC 3227
- Guidelines for Evidence Collection and Archiving, published by the IETF in February 2002. It defines the order of volatility, the documentation requirements...
- Trusted Response Kit
- A portable collection of statically compiled, cryptographically verified forensic tools stored on write-protected media. Used during live response to avoid executing potentially...
Explained in these topics
- The Digital First Responder: Order of Volatility, Seizure and ImagingAcquisition performed while the target system is still powered on, used to capture RAM, running processes and decrypted volumes before shutdown destroys them.
- Live Network State and Process CaptureThe process of collecting evidence and triage data from a running system without first powering it down. Preserves volatile artefacts that would be lost in a t...
- Volatile Data and the Order of VolatilityThe practice of collecting forensic evidence from a running system before any shutdown or imaging. Live response is required whenever volatile data such as enc...