- This event has passed.
Session: Creating VM’s from Forensic Images for Courtroom Presentation (Pre-Recorded)
October 2 @ 4:00 pm - 5:00 pm EDT
Pre-Recorded By: Jeff Shackelford
Directions: This is a pre-recorded session. When you enter the session you will need to press the play button to listen to the recorded webinar. Chat will be open. Questions submitted will be sent to the presenter to answer. Please be sure to connect with Jeff through the members.
One of the biggest hurdles in computer forensic testimony, is figuring out how best to approach all the technical terms, procedures and evidence that needs to be explained and presented to a “non-technical” courtroom. One of the best ways to overcome this hurdle is by providing them with a “virtual tour” of the evidence. By harnessing forensic and VM technology, you can virtually “boot” the suspect’s system by creating a virtual machine from your forensic image file (e.g., .E01, .DD, etc.), and viewing the system just as if you had brought the computer into the courtroom and powered it on. Judges and jurors can now see the system just as the suspect saw it, in its native Windows environment, and you will be able to present your evidence and findings in a much more efficient and effective way. Attendees will learn the process of creating and booting a VM of a forensic image, and how they can use this process to locate additional evidence that’s not typically viewable via traditional forensic tools. Attendees will also learn useful tips and tricks on how to successfully introduce this in a courtroom setting.