Kenneth's boss tells him he must quickly perform a live acquisition before taking their latest client offline due to an active network intrusion. What is the reason for performing a live acquisition as well as the consequence of performing live acquisition in this case? Choose all that apply.
Group of answer choices
Attacker's footprints may only appear in running processes or RAM.
Performing a live acquisition may help you track the attackers back to their original location.
Attackers may still be in the system, and it is the best way to capture them.
Performing a live acquisition causes information on the system to change because the acquisition affects RAM and running processes meaning the information cannot be reproduced.