← All EvidenceCrossChristopher Jon Beeson — Cross-Examination (Continued) Christopher Jon Beeson Joshua Lewis Dratel
Digital Evidence
Laptop RAM capture begun on October 3
Beeson testified that he and an associate began capturing laptop RAM on October 3 and that FMEM crashed the computer during the capture. He said capture continued after a restart, but some unidentified information was permanently lost. He explained that RAM can contain process, network, or malware information without saying those details necessarily appeared in this capture.
About
Cross-examination questioned the completeness of the captured live computer state; the lost information's contents were unknown and were not shown to support either party's account.