WinPmem

What WinPmem does

Physical-memory acquisition

WinPmem is a portable command-line acquisition tool that captures physical memory from a running Windows system. The resulting image can support later analysis of processes, loaded modules, network activity, credentials and other volatile state that may not survive shutdown.

• Use it for
  Focused, authorised acquisition of Windows physical memory.
• Starting material
  A live Windows endpoint, a case reference and a separate destination with sufficient space.
• Successful outcome
  A recorded memory image, acquisition log and integrity hash that another analyst can verify.

Live acquisition changes the system

Loading an acquisition driver and writing an image changes the live endpoint. Record the tool version, command, start and finish times, destination, warnings and observed errors. Use only systems you own or are explicitly authorised to examine.

Choose your journey

01Install and verify

Obtain WinPmem, preserve provenance and prepare the command-line environment.

Complete when the expected executable runs from an elevated console.Beginner · Windows · 10–20 min 02Capture and verify

Create a focused memory image and record the evidence trail.

Complete when the output exists and its integrity record is retained.Guided · Authorised lab · 15–30 min 03Go hands-on

Practise commands in the browser, then complete the isolated Full Lab.

Complete when another analyst can reproduce the acquisition.Browser or self-hosted · 15–90 min

Evidence workflow

1 Authorised endpoint›2 WinPmem driver›3 Memory image›4 Hash and log›5 Analysis copy

Acquisition context

The image is a point-in-time representation affected by acquisition delay, system activity and tool behaviour.

Interpretation limit

A successful command does not prove that the image is complete or that an observed artefact is malicious.

Before you begin

• Scope and source
  Confirm written authority, identify the exact endpoint, and record its system time and time zone.
• Tool and access
  Preserve the executable source, version and checksum, then use an administrator Command Prompt.
• Destination and integrity
  Use a separate controlled volume with sufficient space and plan hashing, transfer and protection.

Evidence quality and limitations

Live-memory limitation

Memory acquisition is inherently non-atomic: memory continues to change while it is copied. Document collection duration, tool messages, destination media, unexpected restarts or security controls, and anything that may have affected coverage. Analyse a verified working copy and retain the acquisition original.