Live acquisitions are done on scene if the computers password/passphrase is available. One of the benefits of doing a live acquisition is when an encrypted drive that is readable only when the computer is powered on or a computer that is accessible only over a network.

What is a live storage acquisition and when is it used?

► Live Acquisition involves the capture of data from a system. that is running when you encounter it. ► Capture before you shut it down, or in lieu of shutting it down. ► Capture of ever-changing data stored on media or memory, including: ► Data stored on internal or external disks.

What is the advantage of live forensic?

With live imaging, an image of RAM can also be captured, providing you with a complete picture of how the system has been used immediately prior to the imaging process. With a static approach, this data is ultimately lost when the system is shut down which prevents access to this volatile and often important ESI.