Understanding Memory Acquisition

Memory acquisition preserves a snapshot of physical memory so an analyst can examine volatile system state after the live collection has finished.

What you will learn

By the end, you should be able to explain why memory is valuable, plan destination capacity, and document the unavoidable effect of acquisition.

Memory acquisition

Core concept

A memory acquisition tool reads accessible physical memory and writes it to an image. The image may contain processes, code, network state, command history, encryption material, and remnants of recently used data.

ProcessesMemory regionsConnectionsHandlesKeys and credentials

Keep in mind: Memory changes continuously. Running the acquisition tool also changes memory, so record the method and collect promptly.

01Physical memoryRAM used by the running operating system and processes02Memory imageThe acquired representation written for later analysis03Page fileDisk-backed virtual-memory data collected separately

Memory acquisition is not memory analysis

AcquisitionCapture volatile state and preserve collection context

AnalysisInterpret structures and artefacts in the acquired image

Process dumpCapture selected process memory rather than all accessible RAM

Hibernation fileA disk artefact created by Windows power management

Why it matters

Capture active state

Memory can show processes, threads, modules, handles, and other live structures.

Preserve connections

Socket and network structures may connect a process to recent communications.

Reveal memory-only behaviour

Injected or unpacked code may be clearer in memory than in files stored on disk.

Retain transient material

Decrypted content, keys, commands, and credentials may exist only temporarily.

Capture workflow

1. AuthoriseRecord the target, authority, investigation question, and operational constraints.
2. PrepareChoose a trusted tool and a destination with capacity exceeding installed memory.
3. Record contextCapture system time, operating-system details, tool version, and relevant live observations.
4. Acquire and monitorRun the tool, avoid unrelated activity, and record errors or security-tool interference.
5. Verify and preserveHash the image, record its size and path, and store it securely with collection notes.

Practice scenario

01 · PrepareA workstation has 32 GB RAM and 20 GB free on its system drive. Where should the image be written?

The system driveA controlled external destination with more than 32 GB availableTake a screenshot instead

Plan the output before changing the live system.

02 · CaptureThe capture is running slowly while the suspicious process remains active. What should the analyst do?

Terminate the process to speed up captureAllow the authorised capture to finish and record timing, errors and observable system effectsOpen more tools and browse the system meanwhile

Memory acquisition changes memory; keep those changes proportionate and documented.

03 · VerifyThe output size is close to installed RAM and the tool reports success. What remains before analysis?

Nothing; the .raw extension proves the capture is validHash the image and record host, times, tool version, path, size and errorsUpload it to a public service for a quick check

Make the capture traceable and protect its sensitive contents.

Quality checklist

Preserve collection context

1. 1PrepareChoose a trusted tool and adequate destination.
2. 2RecordNote system time, state, versions, and commands.
3. 3AcquireMinimise unrelated activity and monitor errors.
4. 4VerifyHash, label, and secure the completed image.

!Plan for acquisition friction

Endpoint protectionDriver loadingLarge RAMSlow storageSystem instabilityTool footprint

Record failures and partial captures. Do not describe an incomplete image as complete evidence.

Choose a tool

Command line

WinPmem

Capture Windows memory with a focused command-line workflow.

Graphical workflow

Magnet RAM Capture

Create a memory image through a straightforward graphical interface.

Alternative capture

Belkasoft Live RAM Capturer

Use an alternative Windows memory-acquisition workflow.

Continue learning

• Explore WinPmem for command-line acquisition.
• Explore Magnet DumpIt for another practical capture option.
• Continue to Understanding Memory Analysis after preserving the image.