With the use of the whole disk encryption, data acquisition are turning to use newer operating systems (OSS) for real-time acquisition, in addition to the problem of encryption, collecting suspect any active data for digital investigation of computer RAM is also becoming more and more important, to obtain real-time disk and RAM data technology introduced in chapter 10, the acquisition of dynamic and static acquisition process and data integrity requirements is similar, because static acquisition capture data can not be other possible access to the flow of change, using real-time access, file metadata (such as the date and time value) at the time of acquisition tool reads changes, for static access, if you retain the original media, then on the second static access should be able to produce the same results, no matter how many times to collect, can't change the data on the original disk, collection of real-time for the second time in a computer run time, because of the dynamic changes in the operating system to collect new data,