23 November 2021 to 27 January 2022
Europe/Amsterdam timezone

Forensics for Admins - Persistent Storage Acquisition II

20 Jan 2022, 11:00


Mr Tobias Dussa (DFN-CERT)


If any data on a computer shall outlast a power switch or a reboot, it has to be written to persistent storage. Investigating the contents of harddisks, SSDs, and transportable media is a standard operating procedure of IT forensics.

The previous webinar covered the basic, agnostic technique of acquiring persistent storage with raw device access and standard copying tools. However, it required access to the operating system with root or administrator privileges. This webinar covers advanced techniques that will do away with some of this preconditions and might be better suited for the job in some situations.

Presentation Materials

There are no materials yet.
Your browser is out of date!

Update your browser to view this website correctly. Update my browser now