Remote Forensics on Live Systems

I posted in /r/CrowdStrike about [using Real Time Response to perform forensics](https://www.reddit.com/r/crowdstrike/comments/vbcmyo/rtr_forensics/).

TL;DR

While CrowdStrike offers Falcon Forensics, some organizations have not purchased it. I have seen a post mentioning [KAPE, Kansa and PowerForensics](https://www.reddit.com/r/crowdstrike/comments/iyunpu/kape_with_rtr/). However, both the Kansa and PowerForensics projects seem to be unmaintained.

Additionally, there were concerns about using KAPE as it could over-write memory, HDD space, etc. For Falcon Forensics, an EXE has to be copied (if not already present on the endpoint) and executed. Couldn't that …

computerforensics forensics live systems