A live CD is a CD containing a bootable computer operating system. Live CDs are widely used in computer forensics and incident response.
- Physical memory of a computer can be imaged by performing cold boot attack without running tools on an untrusted operating system.
- Acquisition over a network connection without running tools on an untrusted operating system.
- No need to reconstruct RAID arrays;
- Out-of-date software;
- No simple way to reconfigure Live CD: you cannot easily rebuild foo to support bar (e.g. rebuild The Sleuth Kit to support AFF.