What is the difference between live forensics and dead-box forensics, and when would you use each approach?

Question

Accepted Answer

Live forensics and dead-box forensics represent two fundamentally different approaches to collecting and analyzing digital evidence, and understanding when to use each is essential for any SOC analyst involved in incident response.

Live forensics refers to the examination and collection of evidence from a system that is still powered on and running. This approach focuses heavily on capturing volatile data, which is information that exists only in the system's current state and will be lost once the machine is powered off. Volatile data includes the contents of RAM, active network connections, running processes, logged-in users, open files, clipboard contents, and the system's routing table. The order of volatility, as defined by RFC 3227, guides analysts to collect the most transient data first. Live forensics is critical when dealing with fileless malware, encrypted volumes that would become inaccessible after shutdown, or when you need to understand real-time attacker activity on a compromised host.

Dead-box forensics, also known as static or post-mortem forensics, involves analyzing a system that has been powered off. The primary artifact in dead-box analysis is a forensic disk image, which is a bit-for-bit copy of the storage media. This approach allows for thorough examination of the file system, deleted files, unallocated space, registry hives, event logs, browser history, and other persistent artifacts. Dead-box forensics is generally considered more forensically sound because the evidence is less likely to change during the analysis process, and the original media can be preserved with a verified hash.

In practice, the choice between the two approaches depends on the situation. If a system is suspected of running active malware or communicating with a command-and-control server, live forensics should be performed first to capture volatile evidence before the system is taken offline. Tools like WinPMEM, FTK Imager, or commercial agents can capture memory dumps and volatile data from a live system. Once the volatile data is secured, the system can be safely shut down and a forensic image created for dead-box analysis.

However, there are scenarios where dead-box forensics is the more appropriate starting point. If a hard drive has been seized as part of a legal investigation, or if a system was already powered off when discovered, dead-box analysis is the only option. It is also preferred when the primary concern is recovering deleted files or analyzing historical activity over a long time period.

A mature SOC typically employs both approaches in a complementary fashion. Live forensics captures the ephemeral state of a compromised system, while dead-box forensics provides the deep, thorough analysis needed to fully reconstruct the incident timeline and identify all artifacts of compromise.