Forensic Tool Functionalities
| Forensic Functionality: | Remote Capabilities / Remote Forensics | |
|---|---|---|
| Technical Parameters: | Ability to acquire or analyze live remote data (e.g., connect to and search live remote systems, collect running processes, files, RAM, etc.) | Ability to acquire or analyze remote data post mortem (e.g., search, preview, or acquire remote hard drive, remote media that has been seized but analyst is accessing it over the network, i.e., remote lab capability) |
| tool support for "live" remote forensics | tool support for "post mortem" remote forensics | |
| "live" remote forensics unsupported | "post mortem" remote forensics unsupported | |