[&] A live acquisition should be performed when you need:
- To examine artifacts in memory -- Correct
- To preserve network connections -- Correct
- To have a record of running process -- Correct
- To preserve the disk in a way that no changes are made