  In contrast to the common habit of taking full bitwise copies of storage
devices before analysis, selective imaging promises to alleviate the problems
created by the increasing capacity of storage devices. Imaging is selective if
only selected data objects from an image that were explicitly chosen are
included in the copied data. While selective imaging has been defined for
post-mortem data acquisition, performing this process live, i.e., by using the
system that contains the evidence also to execute the imaging software, is less
well defined and understood. We present the design and implementation of a new
live Selective Imaging Tool for Windows, called SIT, which is based on the DFIR
ORC framework and uses AFF4 as a container format. We discuss the rationale
behind the design of SIT and evaluate its effectiveness.
