Tracable systems and computer forensics

Hard drive imaging is done usually during the _______________ evidence acquisition:

1.Live

2.Dead

3.both