There're two broad categories of Forensic Acquisitions:
1. Volatile Analysis - Live Analysis, information which would be lost if you turn off the machine. For example, active logon sessions or open ports connected, arp cache poisoning, or processes running at the time of examination, what's in memory at the moment. CIRT needs collect Volatile forensic before they offline the compromised machine.
2. Non-Volatile Analysis - For example, registry, services/applications installed, browser history, timestamps/owner/digital signature of critical system files and hard disk. These information will not be lost when you turn off the machine.

Digital Forensic Acquisition Tools (Aka "Forensic Toolkits") are used in:
1. Establish Security Baseline BEFORE an incident happen.
2. Security Incident Response by CIRT (Critical Incident Response Team) AFTER an incident is detected (Or, when it's happenning!).
3. Penetration Testing/Hacking: foot printing/enumeration/discovery (Legitimate tools used by Security Professionals, when in the wrong hand, can be used for malicious purposes)

With Digital Forensic Tools, Investigator can answer these important questions: Is the machine compromised? If so, how, when (Check System Clock, important! Otherwise you can't make sense of timestamp's and your whole case will fall apart) and what? The Anatomy of the Attack.

During the 1980s, most of digital forensic investigations consisted of "Non-Volatile Analysis", examining digital media directly using non-specialist tools. In the 1990's, several freeware and other proprietary tools (both hardware and software) were created to allow investigations to take place without modifying media - it's important not to modify the media during inspection (Or leave as little foot print as possible) as Digital Evidence may be used in court and any modification may lead to claims of Evidence Tampering.

Recent advances in Forensic Technologies come from Mobile Technologies and Cloud Computing. And, last but not least, tools/GUI for visualization/filtering/comparing of collected Forensic - Forensic data is unless unless you can efficiently search/analyze the collected data.

Computer forensics

Memory forensics

Memory forensics tools are used to acquire and/or analyze a computer's volatile memory (RAM). They are often used in incident response situations to preserve evidence in memory that would be lost when a system is shutdown, and to quickly detect stealthy malware by directly examining the operating system and other running software in memory.

Mobile device forensics

Mobile forensics tools tend to consist of both a hardware and software component. Mobile phones come with a diverse range of connectors, the hardware devices support a number of different cables and perform the same role as a write blocker in computer devices.

Other

References