Today, forensic imaging remains the foundation for all computer forensics.
In fact, forensic imaging is critical when having electronically stored information (ESI) admitted as evidence in courts and tribunals around the world, or performing internal investigations. Consequently, it is more important than ever to identify and utilize the most effective and defensible imaging methods available, while remaining cognizant of any cost concerns that clients may have.
Over the last quarter century, legal requirements have increased the prevalence of and reliance upon computer forensics. Traditionally, computer forensics has been performed by leveraging static imaging, meaning that the process is performed after a workstation is shut down. Yet, with the recent amendments to the Federal Rules of Civil Procedure (FRCP)1, live acquisition (while the workstation is still running) of ESI can provide your firm with significant advantages.
To help you learn more about the power of live imaging and the benefits it can provide your firm and your clients, here are three factors for you to consider: