Dears,
There is an old laptop with low specs of resources. I wanted to recover the deleted items but i don’t want to run autopsy on it not even detached its HDD. Is there a way to acquire the laptop image while it is up and running and then copying the image to analyze it in autopsy on another machine?
Hello,
Yes, there are numerous ways to do it, doing a Google search along the lines of “how to make a live forensic image” will present you with numerous results.
You can pick ones that are GUI/tool based, and ones that you can do from the command line, ones you can run from an external drive, etc. It all comes down to what you, as the person doing the acquisition/creation, are most comfortable with.