Live Acquisition
Definition
Forensic data collection performed on a running, powered-on system. Captures volatile data and allows imaging of encrypted volumes while decryption keys are in memory. Carries a small risk of altering the system state compared to dead-box acquisition.
- Performed on
- A running, powered-on system
- Captures
- Volatile data such as RAM and network state
- Advantage
- Can image encrypted volumes while keys sit in memory
- Risk
- Small chance of altering system state vs dead-box acquisition
Common questions
When is live acquisition preferred over dead-box acquisition?+
When volatile data such as running processes, open connections, or encryption keys held only in RAM would be lost on shutdown, or when full-disk encryption would otherwise block offline imaging entirely.
How is the risk of altering system state during live acquisition managed?+
Examiners use validated, minimally-invasive tools, capture the most time-sensitive volatile data first, and log every command executed so any resulting change to the system is documented and explainable.
Related terms
- Chain of Custody
- The documented chronological record of who collected, handled, transferred, and examined a piece of evidence. For digital evidence, chain of custody includes...
- Preservation Order
- A legal instrument directing a service provider to retain specific data for a defined period pending receipt of a production order or...
- Triage
- The structured process of evaluating an alert to determine whether it is a genuine security incident and, if so, what severity level...
- Volatile Data
- Any digital information that is lost when power is removed or the system state changes. Examples include RAM contents, CPU register values,...
- Write Blocker
- A hardware or software device interposed between a digital storage medium and the forensic workstation that prevents any write commands from reaching...