[sleuthkit-users] mounted origin filesystems ?

[Josep M H. <jm...@me...>]

Hi ,
I wonder if it's really desirable to make the dd images from a live
system mounting the origin hacked filesystems from it , and transferring 
the images with ssh / nc to the analisys host , or if it would be also 
correct to do it with the origin hacked system up and running with the 
filesystems mounted.
Would I find any problems with the second option ?
Any suggestion on this topic ?

Best regards ,
Josep M Homs