Can Live View boot up images acquired from 64bit OS evidence?
Some said Live View could only boot up images acquired from 32bit OS evidence. I have to say that it's not true. Ok, the best way to prove it is let the evidence speak for themselves~
1. Boot up Windows 7 64bit evidence

2. Live View boot up Linux 64bit evidence

I think the reason why some forensic guys "believe" that Live View could not boot evidence suessfully are as below:
1.They forgot mounting tools(ex: FTK Imager) requires Administrator privileges to run.
2.They forgot Live View requires Administrator privileges to run.
3.Whenever they saw any terrible word(ike "error","warning","failed") in the Live View message boxs, they will shut Live View down immediately without hesitate. Acutally they should be more patient, let Live View to parse and analyze those partitions. When completed they could use VMWare to open the snapshot and see if it works or not. Remember one very important thing : "Don't jump to conclusions too soon"...some forensics should get rid of such kind of bad habit...
It's an Open Source Java-based solution. You guys could take a look at it's website and forums:
http://liveview.sourceforge.net/index.html
http://sourceforge.net/p/liveview/discussion/
By the way, VFC is a commercial solution. In my experience, Live View is better than VFC. Of course it's not 100% guarantee to boot up evidence with Live View(or VFC). Still you have chances fail to boot up and see Blue Death screen...
Can Live View boot up images acquired from 64bit OS evidence?的更多相关文章
- Spring Boot文档
本文来自于springboot官方文档 地址:https://docs.spring.io/spring-boot/docs/current/reference/html/ Spring Boot参考 ...
- The Boot Process at a Glance x86/x64系统启动过程解析
哥又来干体力活了.人肉翻译一下: The Boot Process at a Glance This section explains the boot process in sufficient d ...
- 计算机启动boot
原创博文:转载请标明出处:http://www.cnblogs.com/zxouxuewei 零.boot的含义 先问一个问题,"启动"用英语怎么说? 回答是boot.可是,boo ...
- Android自定义控件:图形报表的实现(折线图、曲线图、动态曲线图)(View与SurfaceView分别实现图表控件)
图形报表很常用,因为展示数据比较直观,常见的形式有很多,如:折线图.柱形图.饼图.雷达图.股票图.还有一些3D效果的图表等. Android中也有不少第三方图表库,但是很难兼容各种各样的需求. 如果第 ...
- View 层
package com.test.mvp.mvpdemo.mvp.v1.view; import android.app.ProgressDialog;import android.os.Bundle ...
- Android ANR分析(2)
转自:http://blog.csdn.net/ruingman/article/details/53118202 定义 主线程在特定的时间内没有做完特定的事情 常见的场景 A.input事件超过 ...
- 【故障•监听】TNS-12518、TNS-00517和 Linux Error:32:Broken pipe
[故障|监听]TNS-12518.TNS-00517和 Linux Error:32:Broken pipe 1.1 BLOG文档结构图 1.2 前言部分 1.2.1 导读和注意事项 各位技术爱 ...
- 开源网络操作系统--VyOS
User Guide Jump to: navigation, search Contents 1 Introduction 2 Installation 3 Using the Command-Li ...
- vyos User Guide
vyos User Guide 来源 https://wiki.vyos.net/wiki/User_Guide The VyOS User Guide is focused on providing ...
随机推荐
- [ Redis ] Redis 未授权访问漏洞被利用,服务器登陆不上
一.缘由: 突然有一天某台服务器远程登陆不上,试了好几个人的账号都行,顿时慌了,感觉服务器被黑.在终于找到一个还在登陆状态的同事后,经查看/ect/passwd 和/etc/passwd-异常,文件中 ...
- jquery ready 延迟
$.holdReady(true);//延迟 $.holdReady(false);//解延迟 用于下载文件的时候,异步操作 $.holdReady(true); $.getScript(" ...
- CentOS 6.5 网络配置(转载)
From:http://blog.csdn.net/leave00608/article/details/19814063 1.配置网卡IP地址 vim /etc/sysconfig/network- ...
- 20145305解佳玲 《Java程序设计》第1周学习总结
教材学习内容总结 第一章 Java平台概论 1.先了解了JAVA的历史 2.Java三大平台:Java SE.Java EE与Java ME 3.Java SE的四个组成部分:JVM.JRE.JDK与 ...
- sql server中的锁 事务锁 更新锁 保持锁 共享锁 你知道吗?
锁定数据库的一个表 SELECT * FROM table WITH (HOLDLOCK) 注意: 锁定数据库的一个表的区别 SELECT * FROM table WITH (HOLDLOCK) 其 ...
- springmvc+ajaxFileUpload上传文件(前后台彻底分离的情况下)
首先是导入jar包: web.xml: <servlet> <servlet-name>mvc-dispatcher</servlet-name> <serv ...
- ADO.NET 实体框架 资料收集
https://msdn.microsoft.com/en-us/data/aa937723.aspx https://msdn.microsoft.com/en-us/library/bb39957 ...
- [SQL]SQL语言入门级教材_SQL功能与特性(一)
SQL功能与特性 其实,在前面的文章中,已经提及SQL命令的一些基本功能.然而,通过 SQL命令,程序设计师或数据库管理员(DBA)可以: (一)建立数据库的表格.(包括设置表格所可以使用之空间) ( ...
- 使用spark访问elasticsearch的数据
使用spark访问elasticsearch的数据,前提是spark能访问hive,hive能访问es http://blog.csdn.net/ggz631047367/article/detail ...
- Redis集群搭建&访问
集群搭建步骤 1.创建多个节点: 2.为每个节点指派槽,并将多个节点连接起来,组成一个集群: 3.当集群数据库的16384个槽都有节点在处理时,集群进入上线状态: 要求:搭建一个包含6个节点的Redi ...