When acquiring evidence from a live system, which method best preserves volatile memory that would be lost on shutdown?
-
A
Create a static disk image only
-
B
Perform a RAM dump before any disk imaging
-
C
Power off immediately and image the drive
-
D
Clone the hard drive using a write-blocker