Live Data Forensics

In Spring 2015, international speaker Victor Völzow shared his expertise on Live Data Forensics.

Volatile data

The world of digital forensics is changing. Technological progress means that the field of forensics is moving away from traditional ‘dead box’ forensics, where analysis is primarily done on hard drives, to a world where more and more forensics is now conducted on live data – in what Victor Völzow describes as ‘Live Data Forensics’.

According to Victor, ‘volatile data’ is everywhere, and it is now ubiquitous across all information systems. While volatile data has the potential of holding valuable information, all data can be lost as soon as the plug is pulled from the system. To demonstrate some of the issues associated with volatile data, Victor showed students a series of live demonstrations on how volatile data can be acquired, and how it can be analysed using open source tools. He then concluded with a discussion of the various opportunities, challenges and limitations of Live Data Forensics, and the real need for more research to be conducted in this relatively new area.

About Victor Völzow

Victor Völzow is an international expert in digital forensics, and currently works as a digital forensics trainer in Germany, where he has been training forensic specialists since 2007.