Being prepared to the incident
• Turn off or keep turned on the hw? It Depends
• RAM Clone ? Always
Using the SO or hw specialized with DMA support?
• Take the HD out or clone? Clone
• Physical Manipulation of evidences? For Sure –
Special equipment
• Hard Locks ? You kidding me, right?
