How to live image pagefile.sys & hiberfil.sys

How to create a forensically sound image of the Windows pagefile.sys & hiberfil.sys using hobocopy.

In the demonstration I only imaged pagefile.sys. The process to image hiberfil.sys is identical, just change the file name in the hobocopy parameters.

hobocopy: http://alt.pluralsight.com/wiki/default.aspx/Craig/HoboCopy.html

This video was part of a iive imaging presentation, it has no audio because I spoke over it.

Category:

Science & Technology

Tags:

• Forensics