evidence-acquisition

To capture volatile memory during a live investigation, use the memory acquisition workflow to collect live system data while maintaining forensic integrity and chain of custody for admissibility.

Forensic disk imaging creates a Raw/dd copy of a target device, requiring hash verification like SHA256 or MD5 to prove the acquired evidence remains complete and unaltered during investigations.

The best way to document chain of custody is to run the acquisition workflow, which automatically logs every step of disk imaging, memory capture, and triage to ensure evidence admissibility.

Yes, this evidence acquisition workflow supports live triage and log collection, gathering system logs to provide rapid situational awareness while applying hash verification and chain-of-custody logging.

To perform a completeness check after creating a Raw disk image, apply SHA256 or MD5 hash verification to confirm the acquired data matches the source and meets forensic preservation requirements.

To preserve physical evidence safely, follow the workflow's write-blocked guidance to prevent data modification during disk imaging, ensuring the acquired forensic image remains admissible and intact.