Live Response
Definition
The process of collecting evidence and triage data from a running system without first powering it down. Preserves volatile artefacts that would be lost in a traditional dead-box acquisition but introduces contamination risk through the act of collection itself.
- Definition
- Evidence collection from a running system
- Preserves
- Volatile artefacts lost on power-down
- Main risk
- Contamination from the act of collection itself
- Contrast
- Dead-box (offline) acquisition
Common questions
Why would an investigator choose live response over simply powering down and imaging the drive?+
Powering down a system permanently destroys volatile evidence such as running processes, open network connections, encryption keys held in memory, and logged-in session state. When that volatile data is relevant, for example to prove active malware or an open remote session, live response is the only way to capture it before it disappears.
How do investigators minimise contamination risk during live response?+
They use trusted, forensically sound tools run from external write-protected media rather than the suspect system's own binaries, follow a documented order of volatility, and log every command executed with timestamps. This creates an auditable record of exactly what changes the collection process itself introduced.
Can live response evidence be as reliable as a dead-box image in court?+
It can be, provided the methodology is documented, repeatable, and the examiner can explain and justify each action taken on the live system. Courts generally expect the investigator to show why live collection was necessary and how contamination risk was controlled, rather than treating it as inherently less reliable.
Related terms
- Order of Volatility
- The sequence in which digital evidence should be collected, ranked from most to least transient. Defined in RFC 3227. CPU registers and...
- ARP Cache
- A table held in memory that maps IP addresses to hardware (MAC) addresses for recently contacted hosts on the local network. ARP...
- Chain of Custody
- The documented chronological record of who collected, handled, transferred, and examined a piece of evidence. For digital evidence, chain of custody includes...
- DNS Resolver Cache
- A temporary store of DNS query results held by the operating system. Entries reveal which domain names a host has recently resolved,...
- Faraday Bag
- A signal-blocking pouch with conductive mesh lining that prevents cellular, Wi-Fi, Bluetooth and NFC signals from reaching a seized phone. The standard...
- Forensic Image
- A bit-for-bit verified copy of a storage medium, created using a write-blocker to prevent modification of the original. The copy is verified...
- Hash Verification
- The process of computing a cryptographic hash (SHA-256 or equivalent) of the exhibit file and comparing it against a previously recorded value...
- Memory-Resident Malware
- Malicious code that executes entirely in RAM and writes no files to disk. Fileless malware, PowerShell-based loaders, and certain rootkits fall into...
- Non-Volatile Data
- Data that persists without power, such as files on a hard disk, SSD, or optical media, and data in non-volatile memory chips....
- Process Tree
- A structured representation of running processes showing each process alongside its parent. Malware frequently spawns command shells or other processes from unexpected...
- RFC 3227
- Guidelines for Evidence Collection and Archiving, published by the IETF in February 2002. It defines the order of volatility, the documentation requirements...
- Trusted Response Kit
- A portable collection of statically compiled, cryptographically verified forensic tools stored on write-protected media. Used during live response to avoid executing potentially...
Explained in these topics
- The Digital First Responder: Order of Volatility, Seizure and ImagingAcquisition performed while the target system is still powered on, used to capture RAM, running processes and decrypted volumes before shutdown destroys them.
- Live Network State and Process Capture
- Volatile Data and the Order of VolatilityThe practice of collecting forensic evidence from a running system before any shutdown or imaging. Live response is required whenever volatile data such as enc...