Re: Digital forensics of the physical memory

[David Pick <d.m.pick () qmul ac uk>]

> George and Ben,
>
> > The original author does at one point use the term "image" to describe his
> > evidence collection process.  I think that use of this term was unfortunate
> > because it invites comparison with classical approaches to evidence
> > gathering and standards.  It is not possible to "image" a reality that is
> > constantly changing.  
>
> Could you suggest a suitable term to use?
>
> > A "smear," on the other hand, is a pejorative term
> > which assumes that a changing reality cannot
> > therefore be measured accurately.  
>
> Perhaps you're correct about the use of the term
> "smear"...but how would you go about accurately
> measuring the changes that occur during the use of
> dd.exe?  

I think "image" might be reasonably applied *if* the number of
changes is sufficiently small. Think of an "image" taken by a
camera with a focal-plane shutter... and the "image" generated
by the sort of camera used to resolve "photo-finishes"...

But we have to be clear that the "image" may not be taken at
one instant of time, or between twqo machine bus-cycles.

-- 
        David Pick