In this second part of the Linux Live Forensics series, we explore how to identify suspicious processes, map process hierarchies, and correlate user actions during live system analysis — all using native Linux commands.

Memory forensics begins with acquisition. In this first part of our series, we walk through capturing volatile memory on Windows using FTK Imager, ProcDump, and crash dumps. Learn how to choose the right dump type, preserve evidence integrity with hashing, and apply best practices for real-world investigations.

In digital forensics, every minute counts. Imaging an entire disk is thorough but painfully slow, while manual collection is precise but inefficient. KAPE bridges the gap — portable, fast, and designed to give investigators early leads without the wait.