Capture and Verify Memory¶

Prepare the destination¶

Record the authorised hostname, installed RAM, system time and time zone. Create a case-linked folder on a separate controlled evidence volume with free space greater than installed RAM. The output field expects a directory; Belkasoft creates the timestamped .mem filename within it.

Do not use the source volume when avoidable

Memory acquisition already changes the endpoint. A separate destination reduces avoidable writes and protects capacity on the system volume.

Capture physical memory¶

In Select output folder path, enter or browse to the controlled directory. Review the log pane: confirm that the driver loads and the displayed Total Physical Memory Size is plausible for the recorded source. Select Capture! only after the source, destination, authority and capacity checks agree.

Monitor the log and progress bar without performing unrelated activity. Record start and finish times, driver messages, physical-memory size, output path and any warning, cancellation or failure.

Verify and preserve the result¶

After completion, confirm the timestamped .mem file exists in the selected folder and record its exact filename, byte size and timestamps.

Calculate SHA-256 independently, protect the acquisition copy and create a labelled working copy:

Get-FileHash -Algorithm SHA256 'E:\SUSA-061\memory\WIN11-LAB01_SUSA-061.mem'

Hash the working copy and confirm it matches before analysis. Record whether an approved memory-analysis tool recognises the image and preserve parser warnings. Matching hashes support copy integrity; they do not establish completeness, authorship or malicious intent.

Minimum acquisition record¶

Record	Minimum detail
Boundary	Case, authority, hostname, installed RAM, system time and time zone
Tool	Executable, architecture, version, source and SHA-256
Destination	Controlled volume, folder and pre-capture free space
Run	Start, finish, displayed memory size, messages, warnings and errors
Output	`.mem` filename, path, byte size and timestamps
Integrity	Acquisition-copy and working-copy SHA-256 values
Limitations	Live-system impact, unavailable data and analysis-tool warnings