O'Reilly logo

Computer Evidence: Collection and Preservation, Second Edition by Christopher L. T. Brown

Stay ahead with the world's most comprehensive technology and business learning platform.

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, tutorials, and more.

Start Free Trial

No credit card required

Operating Systems

After an operating system is up and running, what is known as a code page is loaded in memory for execution. This code page essentially contains the low-level functions needed for file I/O as well as the operation of other peripheral devices on the computer such as through communications ports. The code page can reside in physical memory as well as in logical page memory on disk, awaiting movement into the CPU’s registers for execution. As functions are executed by the computer’s CPU, the results of those functions are stored again in physical and logical page memory. Investigators now know that physical memory is volatile and will be lost on system shutdown or loss of power. Logical memory may or may not be lost, depending ...

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, interactive tutorials, and more.

Start Free Trial

No credit card required