Live Acquisition
Definition
Forensic data collection performed on a running, powered-on system. Captures volatile data and allows imaging of encrypted volumes while decryption keys are in memory. Carries a small risk of altering the system state compared to dead-box acquisition.
- Performed on
- A running, powered-on system
- Captures
- Volatile data such as RAM and network state
- Advantage
- Can image encrypted volumes while keys sit in memory
- Risk
- Small chance of altering system state vs dead-box acquisition
Common questions
When is live acquisition preferred over dead-box acquisition?+
When volatile data such as running processes, open connections, or encryption keys held only in RAM would be lost on shutdown, or when full-disk encryption would otherwise block offline imaging entirely.
How is the risk of altering system state during live acquisition managed?+
Examiners use validated, minimally-invasive tools, capture the most time-sensitive volatile data first, and log every command executed so any resulting change to the system is documented and explainable.
Related terms
- Chain of Custody
- The documented history of possession, handling, storage and transfer of an exhibit. It supports traceability between collection and examination, while the significance...
- Preservation Order
- A legal instrument directing a service provider to retain specific data for a defined period pending receipt of a production order or...
- Triage
- The structured process of evaluating an alert to determine whether it is a genuine security incident and, if so, what severity level...
- Volatile Data
- Any digital information that is lost when power is removed or the system state changes. Examples include RAM contents, CPU register values,...
- Write Blocker
- A write blocker prevents supported write commands from reaching specified source media during acquisition. Its effectiveness depends on the interface, configuration and...