Live imaging may be your last resort when acquiring an encrypted device. Since neither bootloader exploits nor custom recoveries can decrypt encrypted partitions, you may need to start and unlock the device with the correct PIN code in order to gain access to the encrypted data partition.
Live imaging of an Android device is similar to the process described in the Imaging via custom recovery – physical imaging via dd section.
Live imaging is considered to be a less forensically-sound method compared to using a custom recovery or other acquisition methods. This method requires a rooted device with BusyBox installed. Rooting an Android device in general is not always safe or possible. Depending on the version of Android and the method used to obtain root access, rooting may modify the device boot image and/or its system and data partitions. Installing BusyBox may or may not modify the system partition. Rooting and installing BusyBox may also alter...