Acquisition: Live, Dead-Box, Triage or Full

What is it?

Acquisition is how evidence is captured. Live acquisition collects from a RUNNING system (memory, volatile state) at the cost of touching it; dead-box acquisition images powered-off storage with maximum integrity but loses everything volatile. Triage acquisition grabs a curated set of high-value artifacts fast; full acquisition images everything, slowly.

Why it matters

The choice is irreversible: power off a machine and its memory is gone forever; spend six hours on a full image and the attacker has six more hours everywhere else.

Where you see it

The first decision of every case: what do we capture, in what order, accepting which trade-off?

What normal looks like

A deliberate, documented choice: memory first if the machine is on and compromise is suspected; triage first when scoping many hosts; full images where depth or legal weight demands it.

What suspicious looks like

Reflexive power-off of a suspected-compromised machine — destroying the memory evidence that held the injected code, live sockets, and keys.

How analysts investigate

By matching acquisition to the question and the constraints: what evidence answers the question, how volatile is it, and how much time does the incident allow?

Common beginner mistakes

Defaulting to full disk images of everything — scoping ten hosts needs triage speed; a full image of each is a week of standing still.

Wadi's suspected server is RUNNING. Team A wants to pull the plug 'to freeze the evidence'. Team B points out that the beacon, the injected code and the attacker's live session exist ONLY in memory — pull the plug and the strongest evidence evaporates. Memory first, then decide about the disk.

Quick check

You must scope a suspected intrusion across 12 workstations by tomorrow. Which acquisition approach fits?

A quick self-check — it doesn't affect your XP or progress.