23 November 2021 to 27 January 2022
Europe/Amsterdam timezone

IT Forensics for System Admins - Persistent Storage Acquisition I

18 Jan 2022, 11:00


Mr Tobias Dussa (DFN-CERT)


If any data on a computer shall outlast a power switch or a reboot, it has to be written to persistent storage. Even cloud storage is only persistent storage on another computer. Investigating the contents of harddisks, SSDs, and transportable media has been a standard operating procedure of IT forensics since the '90s and remains to be so.

But before storage contents can be scrutinised, they will have to be acquired from the suspect computer. This webinar covers the basic principles and techniques behind persistent storage acquisition on Linux, Windows and MacOS operating systems.

Presentation Materials

There are no materials yet.
Your browser is out of date!

Update your browser to view this website correctly. Update my browser now