CopyRight wrote:
So this time its a compromised windows server 2008 with XSS, as a forensic incident handler, the best practice is to image the server (or part of it - specific logs) using imaging software or hardware.
What imaging software would you guys recomment in this example? FTK lite?..
Anything thats compatible with windows server 2008.
FTK imager, and if IT is Not late try to dump ram
↧
