Question

a critical part of live acquisitions is to capture which of the following?
a. hard drive
b. ram
c. bios
d. network logs

Explanation:

Live acquisitions in digital forensics target volatile data that is lost when a system is shut down. RAM (Random Access Memory) stores active, temporary data like running processes, open files, and network connections that are not saved to non-volatile storage like a hard drive. Hard drives hold persistent data, BIOS is firmware for system boot, and network logs are often stored persistently, making RAM the critical volatile data captured in live acquisitions.

Answer:

b. RAM