Summary
To summarize, the basic principles for collecting forensic artifacts, disk images, and memory dumps are similar when investigators have access to the operating system. The process is very similar if they have access to a computer or a device as part of the investigation. What is more important to learn are the steps to gain safe access to an operating system during an incident response situation.
Debunking cloud forensic acquisition is key; however, investigators must familiarize themselves with getting access to the full disk without making significant modifications to the instance, such as adding a new empty disk or installing tools only to create a full disk image and jumping through the challenges of exporting. Most cloud services have the option to snapshot your entire disk; this allows for more accessible collections. As for memory dump, unfortunately, there is no better option than jumping on the infected machine and running tools to dump memory. It is important for...
