Covers the field of 'live forensics', where investigators examine a computer system to collect & preserve critical live data that may be lost if the system is shut down. This book emphasizes a live forensics & evidence collection methodology on both Windows & Linux operating systems in the context of identifying & capturing malicious code.