Tom, a digital forensics investigator, is assigned to investigate a potential insider threat at a company. He arrives at the scene to find that a workstation has been compromised. The suspect, a former employee, allegedly used a malicious USB device to access sensitive files before being caught. Tom quickly begins his investigation, and after isolating the workstation from the network, he powers up the system in a controlled environment. His first task is to collect data stored in the system ' s memory, including active processes, network connections, and clipboard content. Tom knows that this type of data can provide critical information about the actions of the suspect during the time of the attack. Why is Tom prioritizing this data over other types of evidence in this case?
Submit