Survey on the possibility of Windows 10 live login bypass / Inquérito sobre a possibilidade de desvio de login ao vivo no Windows 10

Abstract

There are many scenarios where, during a law-enforcement or incident response situation, it is of interest to obtain live session data stored in volatile memory (RAM) in Windows 10 machines, which may be locked by a login screen prompt. This work attempts to survey the bibliography for methods and tools that could, in theory or in practice, bypass said security mechanism and possibly aid digital forensic investigators and law-enforcement get the full picture of a case.