How to Deal with Blurriness in Live Forensics: A Case of Study

When dealing with live forensics cases, we should modify the volatile memory of the investigated system as little as possible, since it may contain plenty of evidential data. Usually, state-of-the-art live forensics best practices mention very little about how much the volatile memory is affected during a live investigation. As a result, there are only vague and imprecise ideas regarding the uncertainty of the resulting evidence. In this paper we would like to present a clear overview of how to measure the uncertainty of the dd collection tool, which is widely used for obtaining the full memory contents of a live computer-based system. As a result, it will become clear how to control and reduce the error when collecting evidence from the volatile memory.