Skip to content

Magnet DumpIt for Windows Hands-on Labs

Choose the Interactive Lab to practise the command-prompt acquisition without accessing real memory, or complete the Full Lab on an isolated, authorised Windows virtual machine.

Hands-on memory acquisition

Authorise it. Capture it. Verify it.

Acquire physical memory as a Microsoft crash dump, preserve the accompanying JSON and SHA-256 records, and explain what the result can support.

⏱ Setup: 20–30 min · Core exercise: 30–45 min◆ Guided beginner✓ Evidence required
Start the Full Lab

Interactive Lab

Full Lab

Isolated Windows VM · Setup: 20–30 min · Exercise: 30–45 min

Magnet DumpIt Full Lab

Administrator access and evidence storage required

Use an isolated, authorised environment

Acquire memory only from a disposable system you own or are explicitly authorised to examine. DumpIt loads acquisition components and changes the live system. Never practise on a production or personal endpoint.

Before you begin

You need: one Windows x64 VM with 4 GB RAM, administrator access, a clean snapshot, a verified DumpIt executable and a separate evidence volume with at least 6 GB free.

Evidence required

Retain authority, host identity, system time, tool provenance, destination, terminal output, .dmp, .json, SHA-256 value, acquisition timing and errors.

Objective

You are supporting case SUSA-053. The case owner suspects short-lived PowerShell activity on authorised host WIN11-LAB01. Acquire memory before containment, verify the output and prepare a record that another analyst can review. Acquisition preserves volatile state; it does not prove malicious intent.

01

Activity 1: Prepare the boundary

  1. Restore the clean Windows VM snapshot and confirm the hostname, installed RAM, system time and time zone.
  2. Confirm written authority covers live-memory acquisition and expected endpoint change.
  3. Record the DumpIt filename, version, architecture, vendor source and SHA-256 before execution.
  4. Create E:\SUSA-053\memory on a separate controlled volume and confirm free space exceeds installed RAM.
  5. Record why memory is being acquired before containment and which question it may help answer.
Milestone 1Boundary recordedThe source, authority, tool and destination are attributable before elevation.

Expected result The verified x64 executable and controlled destination are ready, with enough capacity for the dump and metadata.

02

Activity 2: Acquire memory

  1. Open an Administrator Command Prompt and change to the verified DumpIt x64 directory.
  2. Start DumpIt.exe. Record the destination proposed by the tool and confirm it ends in .dmp on the controlled evidence volume.
  3. Review the displayed computer name and acquisition prompt. Stop if the host or destination is wrong.
  4. Enter y once to authorise the acquisition. Do not interrupt processing unless safety or storage conditions change.
  5. Record start and finish times, elapsed time, created file size, physical-memory size, inaccessible pages, SHA-256 and JSON path.
  6. Preserve warnings, non-zero status values or a size materially different from installed RAM.
Milestone 2Crash dump createdDumpIt reports completion and identifies the `.dmp`, JSON and SHA-256 records.

Expected result A case-linked Microsoft crash dump exists on the evidence volume and the terminal output reports successful processing.

03

Activity 3: Verify and report

  1. Confirm the .dmp and .json paths exist and record their byte sizes and timestamps.
  2. Run Get-FileHash -Algorithm SHA256 E:\SUSA-053\memory\WIN11-LAB01_SUSA-053.dmp from PowerShell and compare it with DumpIt’s recorded SHA-256.
  3. Protect the acquisition copy and create an identified working copy. Hash the working copy and confirm it matches before analysis.
  4. Open the working copy with an approved tool that supports the Microsoft crash-dump format; record whether it parses and any warnings.
  5. State a bounded conclusion: successful acquisition and matching hashes support integrity and basic usability, not completeness or malicious intent.

Use this case-note structure:

Case and authority:
Source host, RAM, system time and time zone:
DumpIt filename, version, source and pre-execution SHA-256:
Destination, start, finish and elapsed time:
Dump path, JSON path, byte size and status values:
DumpIt SHA-256 and independent SHA-256:
Working-copy verification and parser result:
Errors, acquisition impact and limitations:
Conclusion and next analysis step:
Milestone 3Evidence package reviewableAnother analyst can identify the source, reproduce integrity checks and understand the acquisition limits.

Expected result The independently calculated hash matches, the working copy parses, and the conclusion does not overclaim what acquisition proves.

Full Lab evidence checklist

  • Core completion

    Required for an attributable memory acquisition.

  • Good analyst practice

    Records that strengthen review and recovery.

0 of 8 recorded Mark each item when the evidence has been saved.

Troubleshooting

Symptom First check
DumpIt does not start Confirm x64 architecture, administrator elevation, executable provenance and endpoint-control messages.
Destination is on the source volume Stop before entering y; prepare a controlled evidence volume with sufficient free space.
Acquisition stops or storage fills Preserve the terminal output, record the incomplete file and status, resolve capacity, then begin a new documented attempt.
Created size differs from installed RAM Review dump type, inaccessible-page count, compression or format behaviour, warnings and machine information before deciding whether to reacquire.
Independent hash does not match Stop analysis, protect both copies, verify paths and copying steps, and create a new working copy from the protected acquisition copy.

Clean up

Protect the acquisition original, JSON and notes; remove temporary working material when authorised; record final custody; and restore the disposable VM to its clean snapshot when the exercise is complete.

PreviousMagnet DumpIt overviewReviewReturn to the overview