LiFT
[Live Forensics Toolbox]

⚫ Date, time

⚫ Volatile memory

⚫ clipboard

⚫ Network connection

⚫ Open ports UDP, TCP

⚫ NetBIOS, neighboring network connection

⚫ User Account

⚫Users currently logged on

⚫ Processes

⚫ Running processes

⚫ Running services

⚫ Scheduled Jobs

⚫ Files

⚫ Open files

⚫ Screen capture

⚫ Clipboard