Exam 312-49v11 Topic 4 Question 279 Discussion

Option B. Live Acquisition is the best answer because the computer is actively in use for critical tasks , which means shutting it down for a static or dead acquisition would disrupt operations and may also destroy volatile evidence. In CHFI methodology, when a system is running and immediate evidence preservation is necessary, live acquisition is the appropriate approach.
A live acquisition enables the investigator to capture both volatile and non-volatile evidence while the machine remains operational. This is especially important in data theft cases, where active sessions, memory- resident artifacts, current network connections, running processes, and open documents may be crucial to understanding how the leak occurred. Since the computer is continuously used and the situation is urgent, this method best balances evidentiary need with operational reality.
Differential acquisition is not the right concept here because the question is about choosing the overall acquisition mode. Remote acquisition may be possible in some environments, but it is not the primary answer to the problem described. Static acquisition generally requires the system to be inactive. Therefore, under CHFI data acquisition principles, the correct choice is Live Acquisition .