Posted: Mon Jul 27, 2015 12:19 am Post subject: Can Live View boot up images acquired from 64bit evidence?
Some said Live View could only boot up images acquired from 32bit OS evidence. I have to say that it's not true. Ok, the best way to prove it is let the evidence speak for itself~
I've been using Live View for Live Forensics for so many years. You guys could take a look at my blog as below. I use Live View to boot up 64bit Windows and Linux successfully.
I think the reason why some forensic guys "believe" that Live View could not boot evidence successfully are as below:
2.They forgot Live View requires Administrator privileges to run.
3.Whenever they saw any terrible word(ike "error","warning","failed") in the Live View message boxs, they will shut Live View down immediately without hesitate. Acutally they should be more patient, let Live View to parse and analyze those partitions. When completed they could use VMWare to open the snapshot and see if it works or not. Remember one very important thing : "Don't jump to conclusions too soon"...some forensics should get rid of such kind of bad habit...
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum