25. Live Acquisition

• Live acquisition is one where the suspect operating system is still running, and

  • The suspect's OS will copy the data from the encrypted drives or attached flash drives

• Often used in Missing person investigations

• Increasingly more standard approach compared to "pull the plug" in many cases

• When the computer is up and running and either unlocked or the user consents the password