Acquire and Verify Memory with Magnet DumpIt¶
Prepare the acquisition boundary before starting DumpIt, then preserve enough context for another analyst to verify the image and understand its limitations.
Prepare the acquisition¶
Use a Windows endpoint that you own or are explicitly authorised to examine. Record the case reference, hostname, installed RAM, system time and time zone before execution. Confirm the downloaded executable's source, filename, version, architecture and SHA-256 value.
Select the toolkit directory that matches the endpoint architecture. The preserved SUSA workflow uses the x64 executable in:
Prepare a separate controlled evidence volume where possible. It should have free space greater than installed RAM, plus space for metadata and operational headroom. Avoid writing the dump to the system volume when a suitable evidence destination is available.
Live acquisition changes memory
DumpIt and its acquisition components consume memory, processor time and storage activity while memory is being read. The result is time-bounded, not a perfectly atomic snapshot. Minimise unrelated interaction and record acquisition start and finish times, warnings and errors.
Start DumpIt and review the boundary¶
Open Command Prompt as administrator, change to the verified toolkit
directory and run DumpIt.exe. DumpIt displays the destination path, computer
name and a confirmation prompt before acquisition begins.
Before entering y, confirm that:
- the displayed computer name matches the authorised source;
- the proposed destination is controlled and ends in
.dmp; - the destination has sufficient free space;
- the executable architecture and recorded hash match the approved tool; and
- authority still covers live-memory acquisition and its endpoint impact.
Stop if any boundary is wrong. If the details match, enter y once and monitor
the console until DumpIt reports that processing is complete. Do not treat a
progress or completion message as an integrity check.
Record the result¶
Preserve the terminal output. Depending on the release, it may report the dump type, acquisition timing, created size, physical-memory size, inaccessible pages, status information, a SHA-256 value and an accompanying JSON path.
Compare the reported size with installed memory and review any inaccessible pages, non-zero status, warnings or interruption. A size difference is a reason to investigate the acquisition record; file size alone neither proves failure nor completeness.
Verify and preserve the image¶
Confirm that the .dmp and any accompanying .json file exist at the recorded
paths. Calculate an independent SHA-256 value rather than relying only on the
value displayed during acquisition:
Compare the independent value with the retained acquisition record. Protect the acquisition copy, create a clearly identified working copy, hash that copy and confirm the values match before analysis. Record whether an approved memory analysis tool can parse the working copy and preserve any parser warnings.
Detection of accidental or unauthorised changes between the recorded acquisition and verified working copy.
That acquisition was atomic, every page was accessible, or observed activity was malicious.
Minimum acquisition record¶
| Record | Minimum detail |
|---|---|
| Authority and source | Case reference, hostname, installed RAM and authorised operator |
| Tool provenance | Filename, version, architecture, vendor source and executable SHA-256 |
| Timing | Source system time, time zone, start, finish and elapsed time |
| Destination | Volume identity, path, free-space check and output filenames |
| Acquisition result | Completion message, byte size, inaccessible pages, status, warnings and errors |
| Integrity | DumpIt-reported value, independent SHA-256 and verified working-copy SHA-256 |
| Limitations | Expected live-system changes, interruptions, security-tool interaction and unavailable data |
Use a bounded conclusion
Successful completion, matching hashes and successful parsing support that the recorded copy is usable for controlled analysis. They do not establish malicious intent, authorship or a complete history of endpoint activity.