Magnet DumpIt for Windows Hands on Labs¶

Choose the Interactive Lab to practise the command prompt acquisition without accessing real memory, or complete the Full Lab on an isolated, authorised Windows virtual machine.

Interactive Lab¶

Browser based

Magnet DumpIt for Windows Interactive Lab

No installation

Check the computer and destination, type your response in the DumpIt console, then inspect the saved files and compare a copy. Allow about 5 to 8 minutes.

Case SUSA-053 / before the planned restart

Save the memory for the next analyst.

The team is checking a PowerShell process that ran briefly on WIN11-LAB01. The computer is already isolated and memory capture is approved. RAM may still hold information about programs and connections that would be lost after a restart.

About this case

Source: WIN11-LAB01; Windows x64; 4 GiB installed RAM.
Prepared tool: DumpIt 3.6.20230117 x64, opened as administrator. The checked toolkit was copied to E:\SUSA-053\memory before opening it.
Evidence disk: E: EVIDENCE; NTFS; 18 GiB free. There is room for the image, metadata and a working copy.
Training clock: 6 October 2026, 10:16 NZDT (UTC+13). The console reports UTC.

The recreated console follows the version in the guide's screenshot. This build proposes a filename based on the computer name and time beside the executable. Other versions and options can differ. In real work, check the proposed path before entering y.

This browser exercise does not read RAM, load a driver or create a real dump. Its paths, times, machine details, sizes and hashes are made up for practice. DumpIt creates a Microsoft crash dump here, not a RAW image. The format name does not mean this exercise crashes the computer.

1Confirm
2Capture
3Check
4Hand over

Need a hint?

Type y or n, then press Enter. Enter submits your response in this browser exercise.

Optional practice settings

Proposed destination Model eight unreadable pages Model a write interruption

These are lab settings outside DumpIt. Changing the destination reopens the fictional tool before capture. Failure messages and recovery advice appear in the lab help.

Full Lab¶

Self hosted / real memory capture

Windows VM + evidence disk

Case SUSA-053 / before the planned restart

Save the memory. Check the copy. Leave clear notes.

The team is checking a PowerShell process that ran briefly on a workstation due to restart. Your job is to save its RAM and prepare a checked copy for the next analyst. Practise on your own Windows training VM; you do not need malware for this exercise.

Tick each box after saving its files or notes. This page saves your ticks, but cannot check your VM.

Case brief¶

Your taskCapture RAM, keep the capture record, and check a copy before handing it over.

What you will use

One Windows x64 VM, DumpIt and a separate NTFS evidence disk on E:. Record your actual VM name; it does not need to be WIN11-LAB01.

In this case: the workstation is already isolated, no destructive activity is reported, and the response lead approved capture before the restart. In real work, the team decides when to isolate, capture or restart. Running DumpIt changes memory while it reads it.

Before you start¶

You need: a disposable Windows x64 VM, a clean snapshot, administrator access, Windows PowerShell 5.1 and a checked DumpIt toolkit that supports your Windows build. Extract its x64 folder to C:\Tools\Magnet Toolkit\x64. A 4 GiB RAM VM and a separate 64 GiB NTFS disk on E: keep storage and waiting time manageable.

How to follow: open each numbered step when you reach it. Use Command Prompt for DumpIt and PowerShell for file checks. Check the Look for result before continuing. Allow about 30 to 45 minutes after setup; copying and hashing can take longer on slow storage. Memory analysis is optional.

Setup help and terms

Follow Install and open, then review the real console screenshot. This lab follows 3.6.20230117 x64, the build shown in that screenshot. Confirm your build, licence, support and displayed output before using it; another release can differ. Keep any Windows block message and resolve compatibility or policy issues before continuing.

RAM holds information used by running programs. A DMP is the memory file saved here in Microsoft crash dump format; DumpIt can create it on a running computer without deliberately crashing Windows. The JSON is a separate capture record. A working copy is a copy used for analysis. A SHA-256 hash is a long value calculated from file contents, used here to check whether files match. One GiB is 1,073,741,824 bytes.

Confirm that E: is the intended separate evidence disk, not just another partition on the Windows disk. NTFS supports large files. Save the clean snapshot before starting and plan to keep the evidence disk when restoring Windows. Use this VM only for training; memory files can contain sensitive information.

Activity 1: Prepare the VM¶

Your first winA new case folder, checked toolkit on the evidence disk and a known training process.

1. Prepare the disk and save the starting details

Open Windows PowerShell as administrator on the VM. Keep it open for the later checks. This block creates a new case and copies the x64 toolkit into memory. In the reference build, running DumpIt without options saves beside the executable; staging it here helps keep the dump on E:. Still check the path at the prompt before entering y.

$dtiCase = 'E:\SUSA-053'
$dtiSource = 'C:\Tools\Magnet Toolkit\x64'
if ($PSVersionTable.PSVersion.ToString() -notlike '5.1.*') { throw 'Open Windows PowerShell 5.1.' }
$dtiSourceTool = Get-Item -LiteralPath "$dtiSource\DumpIt.exe" -ErrorAction Stop
$dtiRam = [int64](Get-CimInstance Win32_ComputerSystem).TotalPhysicalMemory
$dtiDisk = Get-Volume -DriveLetter E -ErrorAction Stop
if ($env:SystemDrive -eq 'E:' -or $dtiDisk.FileSystem -ne 'NTFS') { throw 'Use the separate NTFS evidence disk on E:.' }
if ($dtiDisk.SizeRemaining -lt (3 * $dtiRam)) { throw 'Allow more room for the dump, copy and notes.' }
if (Test-Path -LiteralPath $dtiCase) { throw 'Case already exists. Keep it and choose a new case folder.' }
New-Item -ItemType Directory -Path "$dtiCase\memory", "$dtiCase\working", "$dtiCase\notes" -ErrorAction Stop | Out-Null
Copy-Item -Path "$dtiSource\*" -Destination "$dtiCase\memory" -Recurse -ErrorAction Stop
$dtiTool = Join-Path "$dtiCase\memory" 'DumpIt.exe'
$dtiToolHashes = @(Get-FileHash -Algorithm SHA256 -LiteralPath $dtiSourceTool.FullName, $dtiTool -ErrorAction Stop)
$dtiToolHashes | Export-Csv -LiteralPath "$dtiCase\tool-sha256.csv" -NoTypeInformation
if ($dtiToolHashes[0].Hash -ne $dtiToolHashes[1].Hash) { throw 'Staged tool differs from source. Inspect the copy.' }
@(
    'Case: SUSA-053; permission: this training VM only'
    "Operator: $env:USERNAME; VM: $env:COMPUTERNAME"
    "Windows: $((Get-CimInstance Win32_OperatingSystem).Caption)"
    "UTC: $((Get-Date).ToUniversalTime().ToString('o')); time zone: $((Get-TimeZone).Id)"
    "Installed RAM bytes: $dtiRam"
    "Evidence disk: E:; label: $($dtiDisk.FileSystemLabel); free bytes: $($dtiDisk.SizeRemaining)"
    "Tool source: $($dtiSourceTool.FullName); staged tool: $dtiTool"
    "Executable file version: $($dtiSourceTool.VersionInfo.FileVersion)"
) | Set-Content -LiteralPath "$dtiCase\case-context.txt"
Get-Content -LiteralPath "$dtiCase\case-context.txt"

Look for: your VM name, RAM and E: details, two matching tool hashes, and DumpIt.exe in E:\SUSA-053\memory. This folder also holds the copied toolkit files; keep them distinct from the DMP and JSON generated later. In case-context.txt, add the snapshot name, approval, vendor download URL/date, toolkit archive name and architecture. A calculated hash identifies the executable; compare with a trusted published hash if available.

2. Leave a harmless program open for the capture

Open a new Notepad window and type SUSA-053 training only. Leave it open until capture finishes. In Task Manager → Details, find that notepad.exe and note its PID, the number Windows gives a running process. Save its name, PID and opening time in notes\training-process.txt. If several Notepad processes appear, record how you identified yours.

Look for: the open window and saved process note. You now have a known process to check in the optional analysis exercise. DumpIt does not list processes or analyse the typed text. In a real incident, record observed activity; do not add a training program to the suspect computer.

Ready to capture I saved the VM, permission, snapshot, tool source/hash and evidence disk details. I saved the training process name/PID/time and left its window open.You can pause here. If you close Notepad, open it again and record its new PID/time before capture.

Next: check DumpIt's proposed filename and start capture.

Continue to capture

Activity 2: Capture the memory¶

Your next winA saved DMP, its JSON record and an independent check of the reported hash.

Before entering y

The prompt proposes a path on C:, but your prepared disk is E:. What would you do? Answer n, check which executable you opened, and fix the destination before capture.

1. Open DumpIt and check its confirmation prompt

Open Command Prompt as administrator. If you used a different case folder, use its actual path below:

cd /d "E:\SUSA-053\memory"
DumpIt.exe

Only run the second line if the first succeeded and the prompt shows the intended folder. Check the tool banner/version, Computer name and Destination path. The reference build uses a filename such as HOST-YYYYMMDD-HHMMSS.dmp; yours will be different. Keep the generated name rather than assuming WIN11-LAB01_SUSA-053.dmp exists.

Confirm the computer is your authorised VM and the proposed DMP is in the prepared folder on E:.
Save a screenshot of the prompt under notes with a unique attempt label. Record the proposed path and time zone.
Type y, then press Enter. Leave the VM alone as much as possible while processing runs. Keep Notepad open; do not take a VM snapshot or copy/hash the dump during capture.

Look for: Processing... Done. and the final result. If the path or computer is wrong, type n and stop. Check the staged toolkit and disk rather than assuming changing the shell folder controls every version's output.

2. Keep the completion record and check the saved files

Before closing the console, save its output or readable screenshots under notes. Record the displayed version, dump type, start/current time, finish time, elapsed time, created bytes, physical memory value, status, inaccessible page count, SHA-256 and JSON path. Use a unique attempt note such as notes\attempt-01.txt. If a field is absent, record that instead of inventing it.

After processing finishes successfully and DumpIt has returned, use the open PowerShell window. Paste the actual DMP path, actual JSON path and 64-character SHA-256 from the console when asked; omit surrounding quotes from paths. This block saves records before reporting a hash mismatch.

$dtiImage = Read-Host 'Paste the completed DMP path from DumpIt'
$dtiJson = Read-Host 'Paste the JSON path from DumpIt'
$dtiReported = (Read-Host 'Paste the DumpIt SHA-256').Trim().ToUpperInvariant()
if ($dtiReported -notmatch '^[0-9A-F]{64}$') { throw 'Expected a 64-character SHA-256. Check the console.' }
$dtiFiles = @(Get-Item -LiteralPath $dtiImage, $dtiJson -ErrorAction Stop)
if ($dtiFiles.Count -ne 2 -or $dtiFiles[0].Extension -ne '.dmp' -or $dtiFiles[1].Extension -ne '.json') { throw 'Check the DMP and JSON paths.' }
if (@($dtiFiles | Where-Object { $_.DirectoryName -ne "$dtiCase\memory" -or $_.Length -eq 0 }).Count) { throw 'Expected nonempty files in this case memory folder.' }
$dtiRecord = Join-Path "$dtiCase\notes" $dtiFiles[0].BaseName
if (Test-Path -LiteralPath "$dtiRecord-hashes.csv") { throw 'Records already exist. Inspect them; do not overwrite.' }
$dtiFiles | Select-Object FullName, Length, CreationTimeUtc, LastWriteTimeUtc |
    Export-Csv -LiteralPath "$dtiRecord-files.csv" -NoTypeInformation
$dtiHashes = @(Get-FileHash -Algorithm SHA256 -LiteralPath $dtiImage, $dtiJson -ErrorAction Stop)
$dtiHashes | Export-Csv -LiteralPath "$dtiRecord-hashes.csv" -NoTypeInformation
[pscustomobject]@{
    Image = $dtiImage
    DumpItSHA256 = $dtiReported
    IndependentSHA256 = $dtiHashes[0].Hash
    Match = $dtiReported -eq $dtiHashes[0].Hash
} | Export-Csv -LiteralPath "$dtiRecord-reported-check.csv" -NoTypeInformation
Import-Csv -LiteralPath "$dtiRecord-files.csv" | Format-List
Import-Csv -LiteralPath "$dtiRecord-reported-check.csv" | Format-List
if ($dtiReported -ne $dtiHashes[0].Hash) { throw 'DMP hash differs from the console. Keep the result and investigate.' }

Look for: nonzero file sizes and Match: True. Open the JSON in Notepad to check it is readable and belongs to this attempt; keep the original file. The JSON hash records that file's contents, not a hash reported by DumpIt for the JSON. Add the saved CSV paths to the attempt note. You can now close training Notepad.

A completed message and matching hash do not prove that all RAM was saved. Review inaccessible pages, status and errors. Installed RAM, reported physical memory and DMP size may differ; size alone cannot settle whether capture was complete. Memory changes while being read, so the image does not represent every page at one instant.

The capture failed, has missing pages or the fields differ

What you see	What to do
Windows blocks the tool or driver	Keep the message. Check the executable, Windows support and permission before changing security settings.
Write error, disk full or interruption	Keep the console and any partial file. Note why it stopped. Check disk connection, space and write access. A partial dump is not a completed acquisition.
Nonzero status or unreadable pages	Keep the exact status and page count. Check the acquisition record and compatibility; explain any unresolved gap in the handover. A matching copy does not repair missing data.
JSON or reported SHA-256 absent in another build	Check that build's documentation and record the missing field. Independently hash the finished DMP, but do not claim you compared against a value the tool never gave. Ask for help adapting the reference build checks.
Independent DMP hash differs	Recheck the file path and pasted console hash. Keep the mismatch and resolve it before making a checked working copy.

For a retry, keep the earlier attempt and records. Fix or explain the problem, reopen the staged tool and confirm a new destination filename before entering y. If it proposes an existing file, answer n and reopen later rather than overwrite it. Save a new attempt note and repeat the checks using the new paths. Do not erase a failed attempt to make the case look successful.

Capture preserved I saved the completed DMP, JSON and console record, including times, status, gaps and earlier attempts. I saved file details and hashes, and resolved the DMP comparison with DumpIt's reported hash.You can pause after capture and these checks finish. An empty or partial file does not meet the completed capture checkpoint.

Next: check the working copy and write a short handover.

Continue to copy checks

Activity 3: Check and hand over¶

Your final winA checked DMP/JSON copy and notes another analyst can use.

Returning in a new PowerShell window?

Set $dtiCase = 'E:\SUSA-053' using your actual case path. Set $dtiRecord to the full prefix of your saved attempt records, without -hashes.csv, for example E:\SUSA-053\notes\HOST-YYYYMMDD-HHMMSS. The next block reads the original paths from that saved CSV; no new capture is needed.

1. Make a working copy and check both files

Leave the original DMP and JSON in memory. Copy them into working for analysis. This block checks the originals against the saved hashes, then copies and checks each file. It preserves a mismatch result before stopping. Large files can take several minutes to hash and copy.

$dtiSaved = @(Import-Csv -LiteralPath "$dtiRecord-hashes.csv" -ErrorAction Stop)
if ($dtiSaved.Count -ne 2) { throw 'Expected the saved DMP and JSON hashes. Inspect the record.' }
if (Test-Path -LiteralPath "$dtiRecord-copy-check.csv") { throw 'Copy check already exists. Keep it and inspect it separately.' }
$dtiBytes = ($dtiSaved | ForEach-Object { (Get-Item -LiteralPath $_.Path -ErrorAction Stop).Length } | Measure-Object -Sum).Sum
if ((Get-Volume -DriveLetter E).SizeRemaining -lt ($dtiBytes + 1GB)) { throw 'Not enough room for the copies and notes.' }
$dtiChecks = foreach ($dtiSavedFile in $dtiSaved) {
    $dtiCurrent = Get-FileHash -Algorithm SHA256 -LiteralPath $dtiSavedFile.Path -ErrorAction Stop
    if ($dtiCurrent.Hash -ne $dtiSavedFile.Hash) {
        "Original mismatch: $($dtiSavedFile.Path); recorded: $($dtiSavedFile.Hash); current: $($dtiCurrent.Hash)" |
            Add-Content -LiteralPath "$dtiRecord-original-mismatch.txt"
        throw 'Original differs from its saved hash. Keep the files and investigate.'
    }
    $dtiCopy = Join-Path "$dtiCase\working" ([IO.Path]::GetFileName($dtiSavedFile.Path))
    if (Test-Path -LiteralPath $dtiCopy) { throw 'Working file already exists. Check it separately; do not overwrite.' }
    Copy-Item -LiteralPath $dtiSavedFile.Path -Destination $dtiCopy -ErrorAction Stop
    $dtiCopyHash = Get-FileHash -Algorithm SHA256 -LiteralPath $dtiCopy -ErrorAction Stop
    [pscustomobject]@{
        Original = $dtiSavedFile.Path; WorkingCopy = $dtiCopy
        RecordedSHA256 = $dtiSavedFile.Hash; OriginalSHA256 = $dtiCurrent.Hash
        CopySHA256 = $dtiCopyHash.Hash; Match = $dtiCopyHash.Hash -eq $dtiSavedFile.Hash
    }
}
$dtiChecks | Export-Csv -LiteralPath "$dtiRecord-copy-check.csv" -NoTypeInformation
$dtiChecks | Format-List
if (@($dtiChecks | Where-Object { -not $_.Match }).Count) { throw 'Copy mismatch. Keep the result and stop using that copy.' }

Look for: two Match: True results, one for the DMP and one for the JSON. They show the saved record, current original and working copy match. They do not prove all memory was readable or that the PowerShell activity was harmful.

If a copy exists or differs, keep it and its hash. Check paths, transfer and storage; use a separately named folder for a fresh copy from the checked original. Save the comparison separately. Do not silently replace a mismatched copy. Keep originals in controlled storage and use the working DMP for analysis.

2. Choose your conclusion and write the handover

Check your conclusionCapture finished and the hashes match. What can you tell the next analyst?

Choose an answer, then write your note using your actual results.

Save this as handover.txt in the case folder and replace the prompts with your results. Include supporting paths and unresolved problems. Do not claim you found Notepad or PowerShell in the dump unless you analysed it and checked.

Case SUSA-053: save RAM before restart for later review of reported PowerShell activity.
Operator, permission, actual VM name, Windows build, RAM, snapshot, clock/time zone:
Tool banner/version/architecture, source URL/date and tool-sha256.csv:
Evidence disk identity, free space, staged toolkit path and proposed destination:
Each attempt: DMP/JSON paths, times, byte sizes, status, inaccessible pages and console record:
Warnings, errors, partial files and retry reasons:
Reported DMP hash, independent hash and saved comparison result:
Original and working-copy locations; DMP/JSON copy-check results:
Training Notepad name/PID/time: deliberately started for this exercise.
Checked: saved files, original hashes and matching working-copy hashes.
Not checked: analysis-tool readability and reported activity, unless separately analysed.
Limits: live memory changes; hashes do not prove complete capture or harmful activity.
Next: open the working DMP in a compatible analysis tool, assess gaps and check the lead against other evidence.
Case storage, access/transfer notes and VM reset plan:

Look for: a note that names the source, saved files, checks, remaining questions and next step. You have finished the core capture workflow.

Optional: find your training Notepad process

On a separate analysis system, follow the Volatility Workbench v3 guide. Confirm support for the Microsoft crash dump format and your Windows build. Use Browse Image to select the checked DMP in working, choose Windows, then Get Process List. Windows symbols describe memory structures; the tool may need to download them before displaying results.

Look for notepad.exe and compare its PID with notes\training-process.txt. Save the analysis tool version, image path, result and warnings. A matching process row shows that record was present; it does not prove complete capture or malicious activity. This step does not guarantee recovery of the typed text.

If the dump cannot be read, keep the error and check the transfer hash, format, Windows support and symbols before deciding to capture again. Record readability separately from hash integrity. Add the result or unresolved error to the handover; this step is optional.

Finish the lab3. Keep the case before restoring Windows

Keep the evidence disk

Retain the DMP, JSON, console records, hashes, working copies, notes and failed attempts. Open the retained notes and check the original DMP's saved hash before resetting the VM.

Close lab programs and shut down the VM. Record where you kept the case and any transfers or access changes. Restore the clean snapshot through your VM software. Check which disks it includes so you do not roll back or discard the evidence disk with Windows.

Look for: a readable retained case and a saved reset or reset plan. Reset progress only clears the browser ticks; it does not remove your files. Keep the memory files in controlled lab storage.

Ready to hand over I saved matching DMP/JSON copy checks and a handover stating what I checked and what remains. I checked the retained case and recorded the VM reset plan while keeping the evidence disk.Tick these after saving the records. Resolve a hash mismatch before calling a copy checked. Optional memory analysis is not required.

Finish by checking that the files below are saved.

Review the saved files

Full Lab evidence checklist¶

Files to keepSave the two checkpoints in each activity.

Starting detailscase-context.txt, tool-sha256.csv and notes/training-process.txt
CaptureOriginal DMP and JSON in memory/; unique attempt notes, console screenshots, file details and hash comparisons in notes/; keep failed attempts too
Copy and handoverChecked DMP/JSON in working/, saved *-copy-check.csv and handover.txt; explain gaps and missing records

You saved the memory, checked the copy and left a clear next step for the analyst.