Can P2P Marshal Field Edition be used to examine a machine that was booted up using a boot disk?
The short answer is, yes. The Field Edition allows you to turn the Live mode on or off when you create a new acquisition. Live mode is appropriate for live machines where the disk you want to examine is hosting the currently-running operating system. If Live mode is off, Field Edition behaves like the Forensic Edition, but on a portable USB device. If you boot a computer using a forensic boot disk, you can use the non-Live mode of Field Edition to examine the system. Since P2P Marshal is a Windows-based software application, you need to be using a Windows boot disk.