USB for Live forensics

There are alot of programs there could be interesting to have in the USB device. In the event you have to need this USB for Live forensic, i recommend that you have a test on what works for you and your environment.

Here is my reccomendation on 2 scenarios that you can make your USB based on.

Bear in mind, there are not as many tools to the *nix based operating systems. Since the landscape tends to rely on Windows Operating systems. There are how ever still lots of serveres out there that are running various types of linux/unix OS. This we also have to take into consideration.

Prepare the USB

You want to make sure that your USB ia absolutely erased, and the USB you use have to be of good quality. Buy from verbatim, Sandisk, Kingston or some other well known brand, using a cheap USB you got in china or a exibit, simply is not good enough.

Always use brand new one out of the box.

You can consider to have a stack of brand factory new USB lying in you jumpbag, and then invest in a USB with writeblock capability, in case you need to have you USB secured for only storing programs.

An example on this could be this oen fom netac

Aqusition programs

Memory dump

Live Boot

First USB - the lite version

The lite version is a liteweight, since you only want to use this for specific purposes. The tools you have on this USB, should contain tools for *nix envorinments and Win envorinments.