Important Notice: Our web hosting provider recently started charging us for additional visits, which was unexpected. In response, we're seeking donations. Depending on the situation, we may explore different monetization options for our Community and Expert Contributors. It's crucial to provide more returns for their expertise and offer more Expert Validated Answers or AI Validated Answers. Learn more about our hosting issue here.

Can P2P Marshal Field Edition be used to examine a machine that was booted up using a boot disk?

0
Posted

Can P2P Marshal Field Edition be used to examine a machine that was booted up using a boot disk?

0

The short answer is, yes. The Field Edition allows you to turn the Live mode on or off when you create a new acquisition. Live mode is appropriate for live machines where the disk you want to examine is hosting the currently-running operating system. If Live mode is off, Field Edition behaves like the Forensic Edition, but on a portable USB device. If you boot a computer using a forensic boot disk, you can use the non-Live mode of Field Edition to examine the system. Since P2P Marshal is a Windows-based software application, you need to be using a Windows boot disk.

Thanksgiving questions

*Sadly, we had to bring back ads too. Hopefully more targeted.