Live forensics gathers data from running systems, providing additional contextual information that is not available in a disk-only forensic analysis.
No takes yet. Share an insight, caveat, or question.
Frank Adelstein (2006) studied this question.