Title: 2. Performing Live Acquisitions
Course: IN 2005 Digital Forensics > Section: Module 11: Chapter 11 - Virtual Machines, Network Forensics, and Live Acquisitions

Performing Live Acquisitions

1. Live acquisitions are especially useful when you’re dealing with active network intrusions or attacks.  Live acquisitions done before taking a system offline are also becoming a necessity because attacks might leave footprints only in running processes or RAM.
2. Live acquisitions don’t follow typical forensics procedures.
3. Order of volatility (OOV) is how long a piece of information lasts on a system.
4. The general steps to perform a live acquisition, including:
  - Create or download a bootable forensic CD
  - Make sure you keep a log of all your actions
  - A network drive is ideal as a place to send the information you collect
  - Copy the physical memory (RAM)
  - The next step varies, depending on the incident you’re investigating
  - Be sure to get a forensic hash value of all files you recover during the live acquisition