Can Live View boot up images acquired from 64bit OS evidence?
Some said Live View could only boot up images acquired from 32bit OS evidence. I have to say that it's not true. Ok, the best way to prove it is let the evidence speak for themselves~
1. Boot up Windows 7 64bit evidence

2. Live View boot up Linux 64bit evidence

I think the reason why some forensic guys "believe" that Live View could not boot evidence suessfully are as below:
1.They forgot mounting tools(ex: FTK Imager) requires Administrator privileges to run.
2.They forgot Live View requires Administrator privileges to run.
3.Whenever they saw any terrible word(ike "error","warning","failed") in the Live View message boxs, they will shut Live View down immediately without hesitate. Acutally they should be more patient, let Live View to parse and analyze those partitions. When completed they could use VMWare to open the snapshot and see if it works or not. Remember one very important thing : "Don't jump to conclusions too soon"...some forensics should get rid of such kind of bad habit...
It's an Open Source Java-based solution. You guys could take a look at it's website and forums:
http://liveview.sourceforge.net/index.html
http://sourceforge.net/p/liveview/discussion/
By the way, VFC is a commercial solution. In my experience, Live View is better than VFC. Of course it's not 100% guarantee to boot up evidence with Live View(or VFC). Still you have chances fail to boot up and see Blue Death screen...
Can Live View boot up images acquired from 64bit OS evidence?的更多相关文章
- Spring Boot文档
本文来自于springboot官方文档 地址:https://docs.spring.io/spring-boot/docs/current/reference/html/ Spring Boot参考 ...
- The Boot Process at a Glance x86/x64系统启动过程解析
哥又来干体力活了.人肉翻译一下: The Boot Process at a Glance This section explains the boot process in sufficient d ...
- 计算机启动boot
原创博文:转载请标明出处:http://www.cnblogs.com/zxouxuewei 零.boot的含义 先问一个问题,"启动"用英语怎么说? 回答是boot.可是,boo ...
- Android自定义控件:图形报表的实现(折线图、曲线图、动态曲线图)(View与SurfaceView分别实现图表控件)
图形报表很常用,因为展示数据比较直观,常见的形式有很多,如:折线图.柱形图.饼图.雷达图.股票图.还有一些3D效果的图表等. Android中也有不少第三方图表库,但是很难兼容各种各样的需求. 如果第 ...
- View 层
package com.test.mvp.mvpdemo.mvp.v1.view; import android.app.ProgressDialog;import android.os.Bundle ...
- Android ANR分析(2)
转自:http://blog.csdn.net/ruingman/article/details/53118202 定义 主线程在特定的时间内没有做完特定的事情 常见的场景 A.input事件超过 ...
- 【故障•监听】TNS-12518、TNS-00517和 Linux Error:32:Broken pipe
[故障|监听]TNS-12518.TNS-00517和 Linux Error:32:Broken pipe 1.1 BLOG文档结构图 1.2 前言部分 1.2.1 导读和注意事项 各位技术爱 ...
- 开源网络操作系统--VyOS
User Guide Jump to: navigation, search Contents 1 Introduction 2 Installation 3 Using the Command-Li ...
- vyos User Guide
vyos User Guide 来源 https://wiki.vyos.net/wiki/User_Guide The VyOS User Guide is focused on providing ...
随机推荐
- python中urllib, urllib2,urllib3, httplib,httplib2, request的区别
permike原文python中urllib, urllib2,urllib3, httplib,httplib2, request的区别 若只使用python3.X, 下面可以不看了, 记住有个ur ...
- viewpage广告条的制作
package com.itheima27.viewpagerdemo; import java.util.ArrayList; import java.util.List; import andro ...
- ubuntu14.04 wifi驱动安装
重装linux后,一直搜不到wlan0,无法启动wifi,经过重重努力,终于成功,在此简单记录一下. 1. 查看网卡类型: ~$ lspci -nn -d 14e4: :]: Broadcom Cor ...
- Spring中的AOP应用
AOP被称为面向切面编程,AOP中的几个重要概念是: 1.切面.切面就是要实现的功能.切面通常是在多数方法中会用到的相同功能,如写日志. 2.连接点.连接点就是应用程序执行过程中插入切面的地点.如:方 ...
- XML中五个转义字符
字符:<,>,&,",© HTML对应的转移字符:< >&"© XML(只有5个)对应的转义字符: < >& " ...
- 获取当前访问的url
1.获取完全url,包含参数: request.getRequestURL(); 2.获取部分: request,getRequestURI 不包含参数,协议名称 获取访问的参数: request.g ...
- Java中Map的用法
Map的一般用法 1.声明一个Map : Map map = new HashMap(); 2 .向map中放值 ,注意: map是key-value的形式存放的,如: map.put("s ...
- inno setup 在卸载时如果想保留文件 使用uninsneveruninstall
一般来说,inno只卸载你安装的文件,自动生成如Thumb.db(缩略图)等文件,卸载程序是不会删除这些的,此时你希望整个安装目录删除则可用你说的方法删除.若想保留某些文件,则必须在[File]段中拷 ...
- [技巧]把Excel里的数据插入到数据库里的方法
.如果先在6行数据的最后一列在插入一列数据,请先把列名写好,然后再第一行的该列下输入数字, 然后选中该单元格向下拖拽一个单元格然后就能看到黑色的小框, 双击右下角黑色的小点,6行数据就 会填上默认的第 ...
- poj 2406 Power Strings kmp算法
点击打开链接 Power Strings Time Limit: 3000MS Memory Limit: 65536K Total Submissions: 27368 Accepted: ...