Belkasoft Live RAM Capturer Hands on Labs

Choose the browser simulation for coached practice, or complete the Full Lab on an isolated, authorised Windows VM with controlled evidence storage.

Interactive Lab

Full Lab

Self hosted / real memory capture

Belkasoft Live RAM Capturer Full Lab

Windows VM + evidence disk

Case SUSA-061 / before the planned restart

Save the RAM. Check a copy. Leave clear notes.

The team is checking a PowerShell process and a connection that appeared briefly on a workstation due to restart. Your job is to save its RAM and prepare a checked copy for the next analyst. Practise on your own Windows training VM; you do not need malware for this exercise.

Tick each box after saving its files or notes. This page saves your ticks, but cannot check your VM.

Case brief

Your taskSave RAM, keep the capture record and check a copy before handing it over.

What you will use

One Windows x64 VM, Belkasoft Live RAM Capturer and a separate NTFS evidence disk on E:. Record your actual VM name; it does not need to be WIN11-LAB01.

In this case: the workstation is already isolated, no destructive activity is reported, and the response lead approved capture before the restart. In real work, the team decides when to isolate, capture or restart. Running the tool changes memory while it reads it.

Before you start

You need: a disposable Windows x64 VM, a clean snapshot, administrator access, Windows PowerShell 5.1 and a checked Belkasoft toolkit that supports your Windows build. Keep its complete x64 folder at C:\Tools\Belkasoft Live Ram Capturer\x64, including the executable, driver and DLL files. A 4 GiB RAM VM and a separate 64 GiB NTFS disk on E: keep storage and waiting time manageable.

How to follow: open each numbered step when you reach it. Use the Belkasoft window for capture and PowerShell for file checks. Check the Look for result before continuing. Allow about 30 to 45 minutes after setup; copying and hashing can take longer on slow storage. Memory analysis is an optional next step.

Setup help and terms

Follow Install and open, then compare your window with Capture and verify. The guide's reference window has a folder field, log, progress bar and Capture! / Cancel / Close buttons. It does not show a version number. Record the archive and executable details rather than inventing a displayed version, and follow the controls for your checked build if they differ.

RAM holds information used by running programs. A MEM image is the file created by this capture. A working copy is a separate copy used for analysis. A SHA-256 hash is a long value calculated from a file's contents, used here to compare files. One GiB is 1,073,741,824 bytes.

Confirm that E: is the intended separate evidence disk, not just another partition on the Windows disk. NTFS supports large files. Save the clean snapshot before starting and plan to keep the evidence disk when restoring Windows. Use this VM only for training; memory images can contain sensitive information.

Activity 1: Prepare the VM

Your first winA new case folder, saved starting details and a known program to look for later.

1. Check the toolkit and save the VM details

Open Windows PowerShell as administrator on the VM. Keep this window open for the file checks. This block checks for the x64 executable and driver files, makes a new case on E:, and records the hashes of the toolkit files. It does not run the capture tool.

$belkaCase = 'E:\SUSA-061'
$belkaTools = 'C:\Tools\Belkasoft Live Ram Capturer\x64'
if ($PSVersionTable.PSVersion.ToString() -notlike '5.1.*') { throw 'Open Windows PowerShell 5.1.' }
if (-not [Environment]::Is64BitOperatingSystem) { throw 'Use the x64 training VM for this lab.' }
$belkaTool = Get-Item -LiteralPath "$belkaTools\RamCapturer64.exe" -ErrorAction Stop
$belkaDrivers = @(Get-ChildItem -LiteralPath $belkaTools -Filter '*.sys' -File -ErrorAction Stop)
if ($belkaDrivers.Count -eq 0) { throw 'No driver file found. Keep the full checked x64 toolkit together.' }
$belkaRam = [int64](Get-CimInstance Win32_ComputerSystem).TotalPhysicalMemory
$belkaOs = Get-CimInstance Win32_OperatingSystem
$belkaDisk = Get-Volume -DriveLetter E -ErrorAction Stop
if ($env:SystemDrive -eq 'E:' -or $belkaDisk.FileSystem -ne 'NTFS') { throw 'Use the separate NTFS evidence disk on E:.' }
if ($belkaDisk.SizeRemaining -lt (3 * $belkaRam)) { throw 'Allow more room for the image, working copy and notes.' }
if (Test-Path -LiteralPath $belkaCase) { throw 'Case already exists. Keep it and choose a new case folder.' }
New-Item -ItemType Directory -Path "$belkaCase\memory", "$belkaCase\working", "$belkaCase\notes" -ErrorAction Stop | Out-Null
@(
    'Case: SUSA-061; permission: this training VM only'
    "Operator: $env:USERNAME; VM: $env:COMPUTERNAME"
    "Windows: $($belkaOs.Caption); build: $($belkaOs.BuildNumber)"
    "UTC: $((Get-Date).ToUniversalTime().ToString('o')); time zone: $((Get-TimeZone).Id)"
    "Installed RAM bytes: $belkaRam"
    "Evidence disk: E:; label: $($belkaDisk.FileSystemLabel); free bytes: $($belkaDisk.SizeRemaining)"
    "Executable: $($belkaTool.FullName); file version: $($belkaTool.VersionInfo.FileVersion)"
) | Set-Content -LiteralPath "$belkaCase\case-context.txt"
Get-ChildItem -LiteralPath $belkaTools -File -ErrorAction Stop | Get-FileHash -Algorithm SHA256 -ErrorAction Stop |
    Export-Csv -LiteralPath "$belkaCase\toolkit-sha256.csv" -NoTypeInformation
Get-Content -LiteralPath "$belkaCase\case-context.txt"

Look for: your actual VM name, RAM and E: details, plus toolkit-sha256.csv listing the executable and its companion files. Open case-context.txt and add the snapshot name, approval, vendor download URL/date, archive filename and x64 architecture. If a version field is blank, record that. Calculated hashes identify the files you used; compare with trusted published hashes if available. A file existing is not proof that its driver will load.

2. Leave a harmless program open for the capture

Open a new Notepad window and type SUSA-061 training only. Leave it open until capture finishes. In Task Manager → Details, find that notepad.exe and note its PID, the number Windows gives a running process. Save its name, PID and opening time in notes\training-process.txt. If several Notepad processes appear, record how you identified yours.

Look for: the open window and saved process note. You now have a known process to find in the optional analysis exercise. Belkasoft RAM Capturer does not list processes or analyse the typed text. In a real incident, record observed activity; do not add training programs to the suspect computer.

Ready to capture I saved the VM, permission, snapshot, toolkit source/hashes and evidence disk details. I saved the training process name/PID/time and left its window open.You can pause here. Keep PowerShell open through Activity 2. If you close Notepad, open it again and record its new PID/time before capture.

Next: choose a new output folder and save the memory.

Continue to capture ›

Activity 2: Save the memory

Your next winA saved MEM file, capture notes and an independently calculated hash.

Before selecting Capture!

The window starts with the toolkit folder on C:. Replace it with your new folder on E:. A full progress bar is a capture result; you will still need to check the saved file and its copy.

1. Open the tool and prepare a new output folder

In File Explorer, open C:\Tools\Belkasoft Live Ram Capturer\x64. Check that you are opening the executable recorded in case-context.txt, then right click RamCapturer64.exe → Run as administrator. Check the path in the UAC prompt before approving it.

Review the log. The reference shows Loading device driver, Physical Memory Page Size and Total Physical Memory Size. Keep any error and stop if the driver did not load. Compare the displayed memory value with your VM's RAM. The guide's 5120 MB example is a 5 GiB VM; your value may differ. If a difference is unexplained, record both values and check assigned/dynamic memory settings before continuing.

In PowerShell, prepare an empty folder for this attempt and save the time just before capture:

$belkaAttempt = 'attempt-01'
if ($belkaAttempt -notmatch '^attempt-\d{2,}$') { throw 'Use an attempt label such as attempt-01.' }
$belkaRun = Join-Path "$belkaCase\memory" $belkaAttempt
$belkaNote = Join-Path "$belkaCase\notes" $belkaAttempt
if ((Test-Path -LiteralPath $belkaRun) -or (Test-Path -LiteralPath "$belkaNote-capture.txt")) { throw 'Attempt already exists. Keep it and choose a new label.' }
if ((Get-Volume -DriveLetter E).SizeRemaining -lt (2 * $belkaRam + 1GB)) { throw 'Not enough room for a new image, copy and notes.' }
New-Item -ItemType Directory -Path $belkaRun -ErrorAction Stop | Out-Null
@(
    "Attempt: $belkaAttempt; output folder: $belkaRun"
    "Just before Capture UTC: $((Get-Date).ToUniversalTime().ToString('o'))"
    "Executable: $($belkaTool.FullName)"
) | Set-Content -LiteralPath "$belkaNote-capture.txt"
$belkaRun

1. Paste the printed folder into Select output folder path, replacing the C: default. For the first attempt it is E:\SUSA-061\memory\attempt-01.
2. Enter a folder only, not a filename. This reference interface has no separate Browse button and creates a date based .mem name inside the folder. Your build may differ; inspect the actual output.
3. Save a screenshot of the ready window in notes as attempt-01-ready.png, then select Capture! once.

Look for: the green progress bar advancing. Leave the VM alone as much as possible, keep Notepad open, and do not take another VM snapshot or copy/hash the image during capture. If the setup block failed, fix that before selecting Capture!.

2. Save the completion record and hash the MEM file

Wait for the log to say Memory dump completed and record the total memory dumped. Save readable screenshots or copy the log text if your build allows it. Keep the output folder, displayed memory values, times, completion message, warnings and errors in notes\attempt-01-capture.txt. If no errors were shown, write that down. Close the capture tool after recording the result.

Run this only after a successful capture has finished. It finds the one MEM file in this attempt's folder, so you do not need to guess or rename the tool's generated filename:

"Just after completion UTC: $((Get-Date).ToUniversalTime().ToString('o'))" |
    Add-Content -LiteralPath "$belkaNote-capture.txt"
$belkaImages = @(Get-ChildItem -LiteralPath $belkaRun -Filter '*.mem' -File -ErrorAction Stop)
if ($belkaImages.Count -ne 1 -or $belkaImages[0].Length -eq 0) { throw 'Expected one nonempty MEM file. Inspect the folder and capture log.' }
if ((Test-Path -LiteralPath "$belkaNote-image-details.csv") -or (Test-Path -LiteralPath "$belkaNote-image-sha256.csv")) { throw 'Image records already exist. Keep and inspect them.' }
$belkaImage = $belkaImages[0].FullName
$belkaImages[0] | Select-Object FullName, Length, CreationTimeUtc, LastWriteTimeUtc |
    Export-Csv -LiteralPath "$belkaNote-image-details.csv" -NoTypeInformation
Get-FileHash -Algorithm SHA256 -LiteralPath $belkaImage -ErrorAction Stop |
    Export-Csv -LiteralPath "$belkaNote-image-sha256.csv" -NoTypeInformation
Import-Csv -LiteralPath "$belkaNote-image-details.csv" | Format-List
Import-Csv -LiteralPath "$belkaNote-image-sha256.csv" | Format-List

Look for: the actual MEM path, a nonzero byte size and a 64-character SHA-256. The file might be named YYYYMMDD.mem, as in the reference; your date and hash will differ. Add the saved CSV paths to the capture note. The saved times bracket the capture, not the exact moment each page was read. You can now close training Notepad.

A completion message, size and hash do not prove that all RAM was saved. Memory changes while being read. If the size is surprising, compare installed RAM, the displayed memory values, log and completion state; keep any unresolved difference. This tool window does not calculate the independent file hash for you.

The capture was cancelled, failed or looks wrong

What happened	What to do next
Tool or driver blocked	Keep the message. Check elevation, matching architecture, the complete toolkit, Windows support and policy before changing security settings.
Write error or disk full	Keep the log and any partial file. Check E: connection, write access and remaining space.
You selected Cancel	Record when and why. Keep the unfinished attempt; it is not a completed capture.
File absent, empty or unexpectedly sized	Recheck the folder actually shown in the tool, installed RAM, displayed values and log. Keep the result rather than calling it successful.

For a retry, preserve the earlier folder and note. Fix or explain the problem, change $belkaAttempt in Step 1 to 'attempt-02', rerun that block and enter the new folder in the tool. Repeat both steps and save new screenshots and notes. This keeps a same day, date named file from replacing the earlier attempt. Do not rely on unverified collision handling or put a custom filename in the folder field.

Capture saved I saved the completed MEM file, capture times and log/screenshots, including earlier attempts or errors. I saved the actual filename, byte size and independent SHA-256 for the completed image.You can pause after capture and these records are saved. An empty or partial file does not meet the completed image checkpoint.

Next: check the working copy and write the handover.

Continue to copy checks ›

Activity 3: Check and hand over

Your final winA checked working copy and a note another analyst can follow.

Returning in a new PowerShell window?

Set $belkaCase = 'E:\SUSA-061' and $belkaNote = 'E:\SUSA-061\notes\attempt-01' using your actual case and completed attempt paths. The next block reads the image path and hash from that attempt's saved CSV; no new capture is needed.

1. Make a copy and compare its hash

Leave the original in its memory attempt folder. Use a checked copy in working for analysis. This block checks the original against its saved hash before copying, then hashes the copy. Large files can take several minutes to copy and hash.

$belkaSaved = @(Import-Csv -LiteralPath "$belkaNote-image-sha256.csv" -ErrorAction Stop)
if ($belkaSaved.Count -ne 1) { throw 'Expected one original image hash. Inspect the saved record.' }
if (Test-Path -LiteralPath "$belkaNote-copy-check.csv") { throw 'Copy check already exists. Keep and inspect it.' }
$belkaImage = $belkaSaved[0].Path
$belkaCurrent = Get-FileHash -Algorithm SHA256 -LiteralPath $belkaImage -ErrorAction Stop
if ($belkaCurrent.Hash -ne $belkaSaved[0].Hash) {
    "Original mismatch: $belkaImage; recorded: $($belkaSaved[0].Hash); current: $($belkaCurrent.Hash)" |
        Add-Content -LiteralPath "$belkaNote-original-mismatch.txt"
    throw 'Original differs from its saved hash. Keep the result and investigate.'
}
$belkaCopyFolder = Join-Path "$belkaCase\working" ([IO.Path]::GetFileName($belkaNote))
if (Test-Path -LiteralPath $belkaCopyFolder) { throw 'Working folder already exists. Check it separately; do not overwrite.' }
if ((Get-Volume -DriveLetter E).SizeRemaining -lt ((Get-Item -LiteralPath $belkaImage).Length + 1GB)) { throw 'Not enough room for the copy and notes.' }
New-Item -ItemType Directory -Path $belkaCopyFolder -ErrorAction Stop | Out-Null
$belkaCopy = Join-Path $belkaCopyFolder ([IO.Path]::GetFileName($belkaImage))
Copy-Item -LiteralPath $belkaImage -Destination $belkaCopy -ErrorAction Stop
$belkaCopyHash = Get-FileHash -Algorithm SHA256 -LiteralPath $belkaCopy -ErrorAction Stop
[pscustomobject]@{
    Original = $belkaImage; WorkingCopy = $belkaCopy
    RecordedSHA256 = $belkaSaved[0].Hash; OriginalSHA256 = $belkaCurrent.Hash
    CopySHA256 = $belkaCopyHash.Hash; Match = $belkaCopyHash.Hash -eq $belkaSaved[0].Hash
} | Export-Csv -LiteralPath "$belkaNote-copy-check.csv" -NoTypeInformation
Import-Csv -LiteralPath "$belkaNote-copy-check.csv" | Format-List
if ($belkaCopyHash.Hash -ne $belkaSaved[0].Hash) { throw 'Copy mismatch. Keep the result and stop using that copy.' }

Look for: Match: True and three matching hashes. They show the saved hash, current original and copy match. They do not prove that all memory was readable or that the reported activity was harmful.

If a copy already exists, calculate its hash and compare it with the saved original value. Save the result separately. If it differs, keep that file and comparison, check paths/transfer/storage, and make a new copy in a separately named folder from the checked original when appropriate. Do not silently replace a mismatch. Keep originals in controlled storage and use the working file for analysis.

2. Choose your conclusion and write the handover

Check your conclusionThe capture finished and the hashes match. What can you tell the next analyst?

The PowerShell activity was malicious.The copy matches the saved image. Keep the capture record, then check that an analysis tool can read the copy and examine the reported activity.Every memory page was saved at the same moment.

Choose an answer, then write your note using your actual results.

Save this as handover.txt in the case folder and replace the prompts with your results and supporting paths. Include unresolved problems. Do not claim you found Notepad or PowerShell in the image unless you analysed it and checked.

Case SUSA-061: save RAM before restart for later review of reported activity.
Operator, permission, actual VM name, Windows build, RAM, snapshot, clock/time zone:
Toolkit source URL/date, archive name, executable/driver details and toolkit-sha256.csv:
Evidence disk identity, free space and output folder for each attempt:
Each attempt: start/finish notes, displayed memory, log/screenshots, warnings and errors:
Actual MEM filenames, byte sizes and saved independent hashes:
Failed/cancelled attempts and retry reasons:
Original and working-copy locations; copy-check.csv results:
Training Notepad name/PID/time: deliberately started for this exercise.
Checked: saved file, original hash and working-copy hash.
Not checked: analysis-tool readability and reported activity, unless separately analysed.
Limits: live memory changes; hashes do not prove complete capture or harmful activity.
Next: open the checked copy in a compatible analysis tool and check the lead against other evidence.
Case storage, access/transfer notes and VM reset plan:

Look for: a note naming the source, saved files, checks, remaining questions and next step. You have finished the core capture workflow.

Optional: find the training Notepad process

On a separate analysis system, follow the Volatility Workbench v3 guide. Confirm support for your Windows build and this memory format. Use Browse Image to select the checked MEM file in working, choose Windows, then Get Process List. Windows symbols describe memory structures; the tool may need to download them before displaying results.

Look for notepad.exe and compare its PID with notes\training-process.txt. Save the analysis tool version, image path, result and warnings. A matching row shows that process record was present; it does not prove complete capture or harmful activity. This check does not guarantee recovery of the text you typed.

If the image cannot be read, keep the error and check the transfer hash, format, Windows support and symbols before deciding to capture again. Record readability separately from hash integrity and add the result or unresolved error to the handover. This step is optional.

Finish the lab3. Keep the case before restoring Windows

Keep the evidence disk

Retain originals, working copies, hashes, logs, screenshots, notes and failed attempts. Open the retained notes and check the original image's saved hash before resetting the VM.

Close lab programs and shut down the VM. Record where you kept the case and any transfers or access changes. Restore the clean snapshot through your VM software. Check which disks it includes so you do not roll back or discard the evidence disk with Windows.

Look for: a readable retained case and a saved reset or reset plan. Reset progress only clears the browser ticks; it does not remove your files. Keep memory images in controlled lab storage.

Ready to hand over I saved a matching copy check and a handover stating what I checked and what remains. I checked the retained case and recorded the VM reset plan while keeping the evidence disk.Tick these after saving the records. Resolve a hash mismatch before calling the copy checked. Optional memory analysis is not required.

Finish by checking that the files below are saved.

Review the saved files ›

Full Lab evidence checklist

Files to keepSave the two checkpoints in each activity.

• 1Starting detailscase-context.txt, toolkit-sha256.csv and notes/training-process.txt
• 2CaptureOriginal MEM files in separate memory/attempt-* folders; capture notes, logs/screenshots, file details and image hashes in notes/; keep failed attempts too
• 3Copy and handoverChecked copies in working/attempt-*, saved *-copy-check.csv and handover.txt; explain gaps and missing records

You saved the RAM, checked a copy and left a clear next step for the analyst.

PreviousCapture and verify guideReviewReturn to overview