Two versions of ProDiscover can perform remote acquisitions: ProDiscover Investigator and
ProDiscover Incident Response. When connected to a remote computer, both tools use the
same ProDiscover acquisition method described previously. After the connection is established,
the remote computer is displayed in the Capture Image dialog box.
ProDiscover Investigator is designed to capture data from a suspect’s computer while the user
is operating it, which is a live acquisition. Being able to connect to a suspect’s computer
directly allows the following capabilities:
• Preview a suspect’s drive remotely while it’s in use or powered on.
• Perform a live acquisition (also called a “smear” because with an active computer,
disk data is being altered) while the suspect’s computer is powered on.