Live acquisition is the direct capture of digital evidence from a running system while it remains powered on and in use. In cybersecurity, it preserves volatile data such as memory, active sessions, and network connections, which can reveal NHI activity, attacker presence, or identity misuse that offline collection may miss.
What Live Acquisition Means in Digital Forensics
Live acquisition is used when the state of a running system matters as much as the files on disk. It is a preservation method, not just a collection method, because it aims to capture evidence before volatile data disappears or is altered by shutdown, reboots, or routine process activity.
That makes the technique especially valuable when incident responders need to understand what the system was doing at the moment of compromise. Memory images, active connections, logged-on users, running processes, and open handles can all supply context that offline imaging cannot reconstruct later.
Live acquisition is also inherently time-sensitive. The act of collecting evidence from a live host can change the system state, so responders must balance evidentiary value against the risk of overwriting or disturbing data that may be important to later analysis.
Why Live Acquisition Matters for Compromise Analysis
The main value of live acquisition is visibility into volatile evidence. Malware, remote administration tools, injected code, in-memory payloads, and session tokens may exist only while the system remains active, which means they can be lost if an investigator waits for shutdown-based collection.
That is also why live acquisition is often the faster route to understanding attacker presence. It can show whether a host still has active command channels, whether suspicious processes are tied to a user session, and whether identity-related artefacts such as authentication sessions or delegated access are still in memory.
For MITRE ATT&CK Enterprise Matrix, the value of live collection maps well to detecting credential access, persistence, and lateral movement indicators that are often easiest to see while the system is still running.
What Investigators Typically Capture During Live Acquisition
A live response usually focuses on evidence that exists only in memory or through active operating-system state. Common targets include RAM, process lists, network sockets, loaded modules, command history where available, and system artefacts that reveal current activity or recently executed actions.
Because those artefacts can be transient, the acquisition sequence matters. Responders usually prioritise the most volatile data first, then move toward less ephemeral artefacts, so that the evidence most likely to vanish is preserved before the system changes further.
When identity misuse is part of the investigation, live acquisition can help expose evidence that offline disk collection may miss, such as live sessions, cached tokens, or active service interactions. That is often the difference between seeing a historical footprint and seeing an ongoing compromise.
How Live Acquisition Fits Into Forensic Integrity
Live acquisition is a compromise between completeness and preservation. It can reveal the current operational picture, but it also introduces contamination risk because every command, utility, and collector interacts with the target system.
For that reason, practitioners usually document what was run, when it was run, and how the system was handled during collection. A well-controlled live acquisition can still be defensible, but only if the responder can explain why volatile evidence justified the slight disturbance introduced by collection.
The method is most effective when it is paired with disciplined chain-of-custody practices and with an understanding of which artefacts are most likely to evaporate. In practice, the evidentiary question is not whether live acquisition is “cleaner” than offline imaging, but whether the live state contains information that is more important than the risk of altering it.
Risk and Threat Considerations
Live acquisition creates a dual risk: the investigation can disturb the very evidence it is trying to preserve, and an active attacker can sometimes react to collection by hiding processes, dropping connections, or triggering defensive behaviour. The technique is therefore both a preservation tool and a potential point of visibility loss if it is handled poorly.
Failure mechanism: Volatile artefacts such as memory-resident malware, active sessions, and transient network state can disappear or change during response, while a live adversary may use the investigation window to modify, wipe, or obscure evidence.
Impact: Investigators may lose the clearest proof of compromise, misidentify the attacker’s actions, or miss identity misuse that existed only in memory or active session state.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | Credential Access — Credential Access | Live acquisition helps expose active compromise techniques and volatile artefacts tied to attacker access. |
| Recommendation — Map volatile artefacts to credential-access and lateral-movement techniques, then hunt for related attacker activity. | ||
| NIST SP 800-53 Rev 5 | AU-8 — Time Stamps | Live acquisition depends on reconstructing events and preserving forensic timelines accurately. |
| Recommendation — Preserve collection and event timing so volatile evidence remains defensible in forensic analysis. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | Live acquisition is often used to corroborate active compromise alongside logs and runtime evidence. |
| Recommendation — Correlate live-collected artefacts with retained logs to confirm compromise and sequence of events. | ||
Practitioner Guidance
Why practitioners should care: Live acquisition is most defensible when the volatile state is the highest-value evidence source, especially in cases involving memory-only payloads, active access, or uncertain attacker dwell time. It should be chosen deliberately, not as a default response.
What to watch for: The strongest signal is when the incident may involve artefacts that will not survive a reboot or shutdown, such as in-memory execution, live sessions, or network connections that help prove current compromise.
Practitioner takeaway: Treat live acquisition as a time-critical evidentiary decision, not just a collection technique, and prioritise the artefacts that are most likely to vanish first.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 24, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org