[&] A live acquisition should be performed when you need:
- To examine artifacts in memory
- To preserve network connections
- To have a record of running process
- To preserve the disk in a way that no changes are made