criminalistique des données en direct

CONT: Traditional forensics involves seizing the machine and returning it to the lab environment for a forensic analysis. This can destroy information or make information inaccessible, such as RAM [random-access memory] contents, [encrypted] containers, cloud storage data, etc. Live data forensics involves examining the machine on the scene in order to preserve this volatile information.