Which statement best distinguishes live system forensics from disk forensics?

Which statement best distinguishes live system forensics from disk forensics?

• A. Live system forensics analyzes memory in real time on running systems, while disk forensics analyzes data stored on physical media
• B. Disk forensics analyzes memory in real time
• C. Live system forensics only analyzes network logs
• D. Disk forensics only analyzes volatile data

Answer: (A)

The key idea is volatile versus non-volatile data and how each discipline acquires it. Live system forensics focuses on memory and other artifacts that exist only while the system is running, capturing them in real time from a live machine before power is lost. This includes RAM contents, running processes, open network connections, loaded drivers, and other ephemeral data that would disappear if the system were shut down. Disk forensics, on the other hand, examines data stored on physical media after the system is powered down (non-volatile data). It involves creating a bit-for-bit image of storage devices and analyzing file systems, metadata, unallocated space, slack, and deleted data to reconstruct activity and files, regardless of whether the system is currently running. So the best distinction is that live system forensics analyzes memory in real time on running systems, while disk forensics analyzes data stored on physical media. The other statements mischaracterize one or both areas, for example by suggesting memory is analyzed during disk forensics, or by limiting live forensics to network logs, or by implying disk forensics focuses on volatile data.

The key idea is volatile versus non-volatile data and how each discipline acquires it. Live system forensics focuses on memory and other artifacts that exist only while the system is running, capturing them in real time from a live machine before power is lost. This includes RAM contents, running processes, open network connections, loaded drivers, and other ephemeral data that would disappear if the system were shut down.

Disk forensics, on the other hand, examines data stored on physical media after the system is powered down (non-volatile data). It involves creating a bit-for-bit image of storage devices and analyzing file systems, metadata, unallocated space, slack, and deleted data to reconstruct activity and files, regardless of whether the system is currently running.

So the best distinction is that live system forensics analyzes memory in real time on running systems, while disk forensics analyzes data stored on physical media. The other statements mischaracterize one or both areas, for example by suggesting memory is analyzed during disk forensics, or by limiting live forensics to network logs, or by implying disk forensics focuses on volatile data.