In the paper, we discuss the impact of performing live registry response on the target windows system during loading memory acquisition tools. Every running tool on an investigated system leaves artifacts and changes the system state. Therefore, we should verify the registry evidences in court exacted from memory invalid or not. Firstly, we measure the memory uncertainty in a natural running state (without any other extra tasks) and calculate the blurriness both during loading acquisition tools for live forensics. Then, we employ the MemoryAnalyzer which is developed by ourselves to extract the registry from the acquired memory. Finally, we analyze and compare keys, subkeys and values of the extracted registry hive fives with the original one using Windows Registry File Viewer. Experiments on Windows XP Service Pack 2 under VMware® Workstation show that, the memory state are mainly changed by the loading acquisition tool although it is also influenced by its natural running. And what's interesting is that the novel extracted registry subkeys and values can not be deleted by the live memory acquisition tool, just added some keys and values related with acquisition tools in the SYSTEM hive file, and modified key values (usually represent visited or running time) in the SOFTWRE and NTUSER.DAT hive files. Therefore, the registry is trustable even that it is extracted from acquired memory.