Technique
technique:forensic_imaging
Also: forensic image, imaging, remote forensic imaging
Creating copies or images of systems and drives for offline forensic analysis.
Creation and examination of forensic copies of computers and servers during the investigation.
“were given a forensic image of the computer”
“Hop One complied with this search and provided a copy of the server”
Creating copies or images of systems and drives for offline forensic analysis.
“They had one full-time forensics guy and the folks who were running the incident handling group before I was called in were basically saying image everything”
“We could push out our remote forensic imaging element”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| incoming | INVOLVES | World Bank network intrusion | Explicit | 91 |
World Bank network intrusion INVOLVES Forensic imaging
Investigators created forensic images of affected servers and later used remote forensic imaging on a suspect's computer.
Explicit Confidence 99% · Jack Rhysider EP 91 Details
“they had evidence that this attacker had accessed and changed configurations on thirty different servers”
“We could push out our remote forensic imaging element out to them and grab an image of their hard drive.”