As i see it, there is nothing stopping people from doing both.
"Offline" forensics has its limits and if you want a memory dump of a process with (potential) unpacked mallicious code in it (which can be hard to get to or detect in offline mode) then live forensics is the way to go.
Some malware behaves differently in a virtual machine than in a real system, but you can clone a disk and fire it up in a similar (real) piece of hardware and "watch it spin".
This will probably change in time with virtualised systems becoming less known as a "forensic coder" tool-only and more widely adopted by everyone.
Ok thank you for you reply.
What about imaging a virtual disk(Virtualbox)? and Snapshots?
Do we have way(or tool) to read Virtualbox snapshot(.vdi) file and RAM file(.sav) file?
Do we have way(or tool) to read Virtualbox snapshot(.vdi) file
You can convert them to RAW. I'm not sure if it still works but
vditool COPYDD vbox-image.vdi vbox-image.raw