Analysis of digital forensics live system acquisition methods to achieve optimal evidence preservation

Currently in the field of digital forensics, there are numerous books, papers and instructors that have conflicting recommendations on handling evidence preservation during the initial on-the-scene acquisition if the computer is found to be running. Many of the recommendations are based on opinion and to our knowledge there are no studies that perform a scientific analysis that provides evidence for the best way to perform runtime acquisition so as to preserve evidence and minimize data loss. In this paper we report an analysis of available storage techniques using a baseline scenario to determine which methods result in minimum loss of evidence. Thus, our research provides quantitative evidence as to the best methods a digital forensics investigator should use to preserve evidence.