Comment Re:Evidence destruction ? (Score 0) 489
For data to exist in RAM, does it not also have to exist on the hard drive in some fashion also? Browser buffer caches, windows dlls, shared libraries, all are loaded into ram, but also exist on the HD. It's just a load and unload process. Tracking what goes in and out of RAM is simply a matter of auditing HD access. Not brain surgery. Right?
