01 · Acquisition & Triage
Acquiring Linux Evidence: Disk Imaging and Read-Only Mounts
How to acquire Linux evidence soundly: order of volatility, live vs dead acquisition, dd/dc3dd/ewfacquire imaging, cloud snapshots and read-only mounts.
acquisitiondisk-imagingchain-of-custody