thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Intermediate

Live Acquisition

Collecting evidence from a running system, capturing volatile data before it is lost.

Definition

Live acquisition gathers memory, running processes, network connections, logged-on users and open files, and may be required when full-disk encryption would make powered-off images unreadable. It changes the system slightly, so actions must be documented. Dead acquisition images powered-off media.

Example

Capturing RAM and BitLocker recovery data from a running laptop before shutdown.

Exam tip

Encrypted drives favor live acquisition; document all actions taken on the live system.

Related terms