Datenakquise
Data Acquisition
Forensische Datenakquise
Data acquisition is the first and most critical step of any forensic investigation: the forensically sound capture of the relevant data before it is altered. Whether on a powered-down system (static) or during operation (live) — the order follows the volatility of the data. A mistake here can invalidate the entire investigation.
History & facts. A proven principle is the „order of volatility“: the most volatile data is secured first (memory, active connections, processes), then the persistent data (disks). During acquisition, write protection is used and a hash is formed immediately to prove integrity. Depending on the situation, a bit-exact image of the entire disk or a targeted preservation of individual artefacts results.
Outlook & recommendation. The central trade-off is: do I power down the system and risk losing volatile evidence — or do I acquire live and accept minimal changes? There is no universally correct approach; what matters is a reasoned choice and its documentation. Those who act without a plan in an emergency often destroy precisely the traces needed later — which is why a predefined acquisition workflow should be part of every incident-response preparation.