Acquiring Evidence: Live and Static Acquisition

What you'll be able to do

By the end of this lesson you will be able to choose between live and static acquisition and defend that choice.

• Define data acquisition, live acquisition and static acquisition.
• Decide which method suits a situation, using the order of volatility.
• Explain why encryption by default and modern phones make the decision time-sensitive.

What Acquisition Means

Chapter 5 begins with data acquisition: collecting digital evidence from computers, mobile devices, network traffic and other sources while making sure the data remains unaltered. The book names two techniques.

• Live acquisition captures volatile data, such as RAM and running processes, from a device that is switched on, before it is powered off.
• Static acquisition acquires data from a powered-off device by imaging its storage.

Neither is "better". They capture different things, and many cases need both, in the right order.

Static Acquisition: The Classic Method

Static acquisition is the method you met in Part II. The device is powered down according to procedure, its storage is connected through a write-blocker (Lesson 4.2), and a bit-by-bit image is created and verified with hash values. It is repeatable, well understood and changes nothing on the evidence. Its limitation is obvious: anything that existed only while the device was running is gone.

Live Acquisition: Capturing What Disappears

Live acquisition goes after what static acquisition cannot reach: the contents of memory, running programs, open network connections, logged-in sessions and unlocked encrypted volumes. Following the order of volatility from Lesson 2.4, it comes first when a device is found running.

Live work has a catch: any action on a running system changes it, however slightly. Running a memory-capture tool uses some memory and creates traces. That is acceptable only if it is done competently, kept to a minimum and fully documented. That is exactly the UK good-practice principle you met in Lesson 1.4: anyone who must access original data must be competent to do so and able to explain the implications of their actions. In practice, examiners:

• run trusted, tested tools from their own external media, not programs already on the suspect machine;
• write the output to external storage, never to the evidence drive;
• record every action with its time, and hash every output file;
• explain in their report what their actions changed and why the benefit outweighed it.

FTK Imager, for example, can capture the memory of a live Windows system, and frameworks such as Volatility analyze the capture afterwards.

Choosing the Method

Questions that drive the decision:

• Is the device running? If it is off, leave it off. Switching it on changes data.
• Is storage encrypted, and currently unlocked? If so, the key may exist only in memory.
• Could the device be wiped or changed remotely? Phones and connected laptops can be erased over the network, so isolation from networks is part of acquisition.
• Can the system be taken offline? Critical servers often cannot, which forces live collection or, for virtual machines, a snapshot.
• What does the authority and the procedure allow?

Real-World Example

Imagine (a fictional scenario) a warrant at a small company suspected of fraud. Investigators find three devices:

• A desktop that is switched off. It stays off. It is seized and later imaged statically through a write-blocker.
• A laptop that is running and unlocked, with an encrypted drive and an accounting program open. A trained examiner photographs the screen, captures memory to external media with a validated tool, and records the time and the hash. With the authority's scope in mind, she also makes a targeted logical copy of the open accounting data while it is readable. Then the laptop is shut down according to procedure and imaged later.
• An unlocked smartphone on the desk. It is isolated from all networks to prevent remote wiping and passed straight to the mobile forensics specialist, because the phone's lock and encryption state can change with time.

Each device got the method its condition demanded, and each decision was written down.

From the Book to 2026

What the book teaches. Live acquisition captures volatile data such as RAM and running processes before power-off; static acquisition images powered-off devices.

Why it made sense. The two techniques, and the idea of capturing volatile data first, are as valid now as when written.

What has changed. The timing pressure is greater. Microsoft documents that device encryption turns on automatically on many Windows 11 devices, so a running, unlocked laptop may be the only chance to see its data in readable form. Phones add a clock that keeps running after seizure. Security researchers found in 2024 that iOS 18 includes an inactivity reboot: since iOS 18.1, an iPhone that has not been unlocked for 72 hours (three days) restarts itself. Researchers who reverse-engineered the feature confirmed the timer. After the restart the phone is in its "Before First Unlock" state, which is significantly harder to examine than "After First Unlock". The practical lesson is clear: the longer a seized phone waits, the harder it can become to examine.

What to do now. Plan acquisition before you arrive. Bring validated live-response tools and external media, decide in advance who may perform live work, and move phones to specialists quickly, isolated from networks and with their condition recorded.

Watch: Order of Volatility

This short episode from SANS Digital Forensics and Incident Response explains the order of volatility, the principle behind deciding what to collect first.

Questions to keep in mind as you watch:

• Which kinds of data are the most volatile, and why?
• How does the order shown compare with the RFC 3227 list in Lesson 2.4?
• How would you apply it to the laptop in this lesson's real-world example?

The video complements what you just read. The lesson is complete without it. For an optional introduction to analyzing memory once it has been captured, see the further-study link on this lesson.

What Would You Do?

A company's critical database server is suspected of running hidden malware that steals customer records. It cannot be switched off without stopping the business. The IT director asks whether forensics is even possible without shutting it down. What do you tell them? Decide, then compare with the model answer in the note below.

Knowledge Check

Key Takeaways

• Acquisition collects evidence while keeping it unaltered: live for running devices, static for powered-off ones.
• Live acquisition captures memory, processes, connections and unlocked data, but changes the system slightly, so it must be minimal, competent and documented.
• Leave off what is off. Isolate phones and connected devices from networks to prevent remote wiping.
• Encryption by default and phones' inactivity reboot make acquisition time-sensitive.

Sources

• Dr. Tahseen Al-Doori — IT Forensics Essentials: Concepts, Tools, and the Practice of Digital Investigation, Chapter 5 (a)
• IETF — RFC 3227: Guidelines for Evidence Collection and Archiving
• Digital Detective — ACPO Good Practice Guide for Digital Evidence (principles)
• Microsoft Learn — BitLocker overview: device encryption
• TechCrunch — New Apple security feature reboots iPhones after 3 days, researchers confirm (14 November 2024)
• Magnet Forensics — Understanding the security impacts of iOS 18's inactivity reboot
• NIST — SP 800-101 Rev. 1: Guidelines on Mobile Device Forensics
• Exterro — FTK Imager (memory capture from live devices)
• The Volatility Foundation