Acquire and Verify Memory with Magnet DumpIt¶
Prepare the acquisition boundary before starting DumpIt, then preserve enough context for another analyst to verify the image and understand its limitations.
Prepare the acquisition¶
Use a Windows endpoint that you own or are explicitly authorised to examine. Record the case reference, hostname, installed RAM, system time and time zone before execution. Confirm the downloaded executable's source, filename, version, architecture and SHA-256 value.
Select the toolkit directory that matches the endpoint architecture. The preserved SUSA workflow uses the x64 executable in:
Prepare a separate controlled evidence volume where possible. It should have free space greater than installed RAM, plus space for metadata and operational headroom. Avoid writing the dump to the system volume when a suitable evidence destination is available.
Live acquisition changes memory
DumpIt and its acquisition components consume memory, processor time and storage activity while memory is being read. The result is time bounded, not a perfectly atomic snapshot. Minimise unrelated interaction and record acquisition start and finish times, warnings and errors.
Start DumpIt and review the boundary¶
For the 3.6.20230117 build shown below, the no options workflow proposes a filename based on the computer name and time beside the executable. Copy the checked toolkit to your prepared evidence folder before opening it if using that workflow. Changing only the shell's current directory is not a substitute for checking the proposed output path. Other releases and options can differ.
Open Command Prompt as administrator, change to the staged toolkit
directory and run DumpIt.exe. DumpIt displays the destination path, computer
name and a confirmation prompt before acquisition begins. The reference
screenshot ran from C:; the Full Lab stages the toolkit on E:.
Before entering y, confirm that:
- the displayed computer name matches the authorised source;
- the proposed destination is controlled and ends in
.dmp; - the destination has sufficient free space;
- the executable architecture and recorded hash match the approved tool; and
- authority still covers live memory acquisition and its endpoint impact.
Stop if any boundary is wrong. If the details match, enter y once and monitor
the console until DumpIt reports that processing is complete. Do not treat a
progress or completion message as an integrity check.
Record the result¶
Preserve the terminal output. Depending on the release, it may report the dump type, acquisition timing, created size, physical memory size, inaccessible pages, status information, a SHA-256 value and an accompanying JSON path.
Compare the reported size with installed memory and review any inaccessible pages, nonzero status, warnings or interruption. A size difference is a reason to investigate the acquisition record; file size alone neither proves failure nor completeness.
Verify and preserve the image¶
Confirm that the .dmp and any accompanying .json file exist at the recorded
paths. Calculate an independent SHA-256 value rather than relying only on the
value displayed during acquisition:
Use the actual generated filename displayed by your run, not an assumed case filename. After capture finishes, paste the recorded path without surrounding quotes when prompted:
$dumpItImage = Read-Host 'Paste the completed DMP path from DumpIt'
Get-FileHash -Algorithm SHA256 -LiteralPath $dumpItImage
Compare the independent value with the retained acquisition record. Protect the acquisition copy, create a clearly identified working copy, hash that copy and confirm the values match before analysis. Record whether an approved memory analysis tool can parse the working copy and preserve any parser warnings.
Detection of accidental or unauthorised changes between the recorded acquisition and verified working copy.
That acquisition was atomic, every page was accessible, or observed activity was malicious.
Minimum acquisition record¶
| Record | Minimum detail |
|---|---|
| Authority and source | Case reference, hostname, installed RAM and authorised operator |
| Tool provenance | Filename, version, architecture, vendor source and executable SHA-256 |
| Timing | Source system time, time zone, start, finish and elapsed time |
| Destination | Volume identity, path, free space check and output filenames |
| Acquisition result | Completion message, byte size, inaccessible pages, status, warnings and errors |
| Integrity | DumpIt reported value, independent SHA-256 and verified working copy SHA-256 |
| Limitations | Expected live system changes, interruptions, security tool interaction and unavailable data |
Use a bounded conclusion
Successful completion, matching hashes and successful parsing support that the recorded copy is usable for controlled analysis. They do not establish malicious intent, authorship or a complete history of endpoint activity.