Magnet RAM Capture Hands on Labs

Interactive Lab

Full Lab

Self hosted / real memory capture

Magnet RAM Capture Full Lab

Windows VM + evidence disk

Case SUSA-047 / a workstation due to restart

Save the memory and check a copy.

The team is checking an unusual sign in and a PowerShell process that ran briefly. Your job is to save the computer's RAM before a planned restart and leave clear notes for the next analyst. Use your own Windows training VM. A memory image is a file containing the captured RAM; you do not need malware for this exercise.

Tick each box after saving the files or notes it asks for. This page saves your ticks, but cannot check your VM.

Case brief

Your taskSave RAM, check that a copy matches, and tell the next analyst what you did.

What you will use

One Windows x64 VM, Magnet RAM Capture and a separate NTFS evidence disk on E:. Use your actual VM name in the notes.

In this case: the computer is already isolated, no destructive activity is reported, and the response lead approved capture. In a real incident, the team decides when to isolate or restart the computer. Running the tool changes memory while it is being read.

Before you start

You need: a disposable Windows x64 VM, a clean snapshot, administrator access, Windows PowerShell 5.1 and a Magnet RAM Capture build that works on that VM. Put the checked executable in C:\Tools\Magnet RAM Capture. Use a separate NTFS disk on E: for the captured memory and its copy. A VM with 4 GiB RAM and a 64 GiB evidence disk keeps storage and waiting time manageable.

How to follow the lab: use the Magnet RAM Capture window for capture and PowerShell for file checks. Open each numbered step when you reach it. Check its Look for result before moving on. Allow about 30 to 45 minutes after setup; slow storage can take longer. Memory analysis is an optional next step.

Help with setup or unfamiliar terms

Follow Install and open. Check the download source, filename, version and licence. The guide shows v1.2.0; other releases or Windows builds may behave differently. If Windows blocks the executable or driver, keep the message and check tool support and policy before continuing.

RAM holds information used by running programs. A memory image is the file created by capture. A working copy is a separate copy used for analysis. A SHA-256 hash is a long value calculated from a file's contents, used here to compare the original and copy. One GiB is 1,073,741,824 bytes.

Confirm that E: is your separate evidence disk. NTFS supports large files, which is why this lab uses Don't Split. Save the clean snapshot before starting and arrange to keep the evidence disk when you restore it. Use this VM only for training; memory can contain personal data and credentials.

Activity 1: Prepare the VM

What you will saveThe VM details, tool hash, evidence disk check and a harmless program to look for later.

1. Create a new case folder and save the starting details

Open Windows PowerShell as administrator on the VM. Keep this window open for the file checks. This block checks for one executable in the tools folder and creates a new case on E:. If the folder has more than one executable, inspect it and keep only the checked capture tool there before repeating the check.

$mrcCase = 'E:\SUSA-047'
if ($PSVersionTable.PSVersion.ToString() -notlike '5.1.*') { throw 'Open Windows PowerShell 5.1.' }
$mrcTools = @(Get-ChildItem -LiteralPath 'C:\Tools\Magnet RAM Capture' -Filter '*.exe' -File -ErrorAction Stop)
if ($mrcTools.Count -ne 1) { throw 'Expected one checked capture executable. Inspect the tools folder.' }
$mrcTool = $mrcTools[0].FullName
$mrcRam = [int64](Get-CimInstance Win32_ComputerSystem).TotalPhysicalMemory
$mrcDisk = Get-Volume -DriveLetter E -ErrorAction Stop
if ($env:SystemDrive -eq 'E:' -or $mrcDisk.FileSystem -ne 'NTFS') { throw 'Use the separate NTFS evidence disk on E:.' }
if ($mrcDisk.SizeRemaining -lt (3 * $mrcRam)) { throw 'Allow more room for the image, working copy and notes.' }
if (Test-Path -LiteralPath $mrcCase) { throw 'Case already exists. Keep it and choose a new case folder.' }
New-Item -ItemType Directory -Path "$mrcCase\memory", "$mrcCase\working", "$mrcCase\notes" -ErrorAction Stop | Out-Null
@(
    'Case: SUSA-047; permission: this training VM only'
    "Operator: $env:USERNAME; VM: $env:COMPUTERNAME"
    "Windows: $((Get-CimInstance Win32_OperatingSystem).Caption)"
    "UTC: $((Get-Date).ToUniversalTime().ToString('o'))"
    "Time zone: $((Get-TimeZone).Id)"
    "Installed RAM bytes: $mrcRam"
    "Evidence disk: E:; label: $($mrcDisk.FileSystemLabel); free bytes: $($mrcDisk.SizeRemaining)"
    "Tool: $mrcTool; file version: $($mrcTools[0].VersionInfo.FileVersion)"
) | Set-Content -LiteralPath "$mrcCase\case-context.txt"
Get-FileHash -Algorithm SHA256 -LiteralPath $mrcTool |
    Export-Csv -LiteralPath "$mrcCase\tool-sha256.csv" -NoTypeInformation
Get-Content -LiteralPath "$mrcCase\case-context.txt"

Look for: your VM's actual name, Windows version, RAM and disk details. Open case-context.txt in Notepad and add the snapshot name, tool source URL, download date, displayed tool version and who approved this exercise. The tool hash records which executable you used; compare it with a trusted published hash if one is available. The space check leaves room for both files and notes, but still watch for disk space errors during capture.

2. Open a harmless program and record its PID

Open a new Notepad window on the VM. Type SUSA-047 training only and leave the window open until capture finishes. The text can remain unsaved. This gives you a known program to look for in the optional analysis step.

Open Task Manager → Details, find notepad.exe, and record its PID in notes\training-process.txt. A PID is the number Windows gives a running process. Also record when you opened it and how you identified the correct process if more than one Notepad is listed.

Look for: the open window and saved name/PID/time record. This program is harmless and deliberately started for training. In a real incident, record the activity you observe; do not add training programs to the suspect computer. The capture tool will not show a process list or analyse the text.

Ready to capture I saved the VM, permission, snapshot, tool source/hash and evidence disk details. I recorded the training Notepad process and left its window open.You can pause here. If you close Notepad, open it again and record the new PID/time before capturing.

Next: choose the filename and save the VM's memory.

Continue to capture ›

Activity 2: Save the memory

What you will saveThe original image, capture times, settings, completion message and file hash.

Before you start

If the tool says it saved RAM successfully, what should you still check? Think about the saved file, errors and the copy you will give to another analyst.

1. Set the filename and start the capture

In File Explorer, open C:\Tools\Magnet RAM Capture. Check that you are opening the executable recorded in case-context.txt, then right click it and choose Run as administrator. Check the path in the UAC prompt. Review the licence if it appears.

1. Leave Segment size on Don't Split for the NTFS evidence disk.
2. Select Browse, go to E:\SUSA-047\memory, enter WIN11-LAB01_SUSA-047 as the filename, keep **Raw/Bin File (*.raw)**, then select Save.
3. Check the full output path and displayed memory to capture value. Compare it with your VM's RAM. Your value will differ from the guide's 5,120 MB example. If there is an unexplained difference, record both values and check the VM's memory settings before continuing.

WIN11-LAB01 is the example filename. Your VM does not need that name; its actual name is saved in the case notes. If you changed the case folder in Activity 1, use that same folder in Browse and for your notes. Follow the controls for your checked build if they differ from v1.2.0. See Capture memory for the reference screenshots.

Just before selecting Start, run this in PowerShell to save the filename and time. These checks stop you reusing an earlier image or attempt note.

$mrcAttempt = 'WIN11-LAB01_SUSA-047'
$mrcImage = Join-Path "$mrcCase\memory" "$mrcAttempt.raw"
$mrcNote = Join-Path "$mrcCase\notes" "$mrcAttempt-capture.txt"
if ((Test-Path -LiteralPath $mrcImage) -or (Test-Path -LiteralPath $mrcNote)) { throw 'Attempt already exists. Keep it and choose a new name.' }
@(
    "Image: $mrcImage"
    "Just before Start UTC: $((Get-Date).ToUniversalTime().ToString('o'))"
    "Tool: $mrcTool"
    "Segment size: Don't Split"
) | Set-Content -LiteralPath $mrcNote
$mrcImage

Check that the path printed by PowerShell matches Save RAM capture to... in the tool. If the block reported an error or the paths differ, stop and fix that before selecting Start. Leave the VM alone as much as possible while it runs. Do not take another VM snapshot during capture. Keep the training Notepad window open.

Look for: the progress bar and memory counter advancing. Keep any error or cancellation message. Do not copy or hash the image while capture is running.

2. Record completion, check the file and calculate its hash

When the MRC success dialog appears, take a screenshot and save it under notes with the attempt name, such as WIN11-LAB01_SUSA-047-complete.png. Note the exact message and output path before selecting OK. Close the tool after recording those details. If it failed or you cancelled, use the help below instead of calling the attempt successful.

Return to PowerShell and run this after the successful capture has returned:

"Just after completion UTC: $((Get-Date).ToUniversalTime().ToString('o'))" |
    Add-Content -LiteralPath $mrcNote
$mrcFile = Get-Item -LiteralPath $mrcImage -ErrorAction Stop
if ($mrcFile.Length -eq 0) { throw 'Image is empty. Keep the message and inspect the capture.' }
$mrcFile | Select-Object FullName, Length, CreationTimeUtc, LastWriteTimeUtc |
    Export-Csv -LiteralPath "$mrcCase\image-details.csv" -NoTypeInformation
Get-FileHash -Algorithm SHA256 -LiteralPath $mrcImage -ErrorAction Stop |
    Export-Csv -LiteralPath "$mrcCase\image-sha256.csv" -NoTypeInformation
Import-Csv -LiteralPath "$mrcCase\image-details.csv" | Format-List
Import-Csv -LiteralPath "$mrcCase\image-sha256.csv" | Format-List

Look for: the right path, a nonzero byte size and a 64-character SHA-256. Your hash will differ from anyone else's capture. Add the displayed RAM value, completion message, warnings and errors to the attempt's capture note. If you saw none, write that down. The saved times bracket the capture; they are not exact times for every memory page.

A success message, file size and hash do not prove that every part of RAM was saved. Memory changes throughout capture. A surprising size needs checking against reported RAM, settings and messages; it is not enough by itself to call a capture complete or incomplete. You can now close the training Notepad window.

The capture failed, was cancelled or looks wrong

What happened	What to do next
Windows blocked the tool or driver	Keep the message. Check permission, the executable and compatibility with this Windows build. Ask for help before changing security settings.
Write error or disk full	Keep the partial file and message. Check that E: is connected, writable and has enough free space.
You cancelled	Note the time and why. Keep the unfinished image; it is not a completed capture.
RAM values differ	Record both values and check the VM's assigned/dynamic memory settings. Resolve the difference before capture.
Saved size is surprising	Recheck the path, RAM value, file format, split setting and messages. Keep the evidence of any problem.

For a retry, keep the earlier file and note. Fix or explain the problem first. Choose a new name such as WIN11-LAB01_SUSA-047-retry01.raw in Browse, change $mrcAttempt in Step 1 to 'WIN11-LAB01_SUSA-047-retry01', and repeat both capture steps. Record the reason for retry in both notes. If you already saved image detail/hash records for the earlier attempt, keep copies of them under that attempt?s name in notes before repeating Step 2. Do not overwrite a partial capture to make the case look successful.

Capture saved I saved the image, settings, times and completion message, including failed attempts or errors. I saved the completed image's path, byte size and SHA-256.You can pause after the tool has finished and these records are saved. A partial or empty file does not meet the completed image checkpoint.

Next: make a copy and check that its contents match.

Continue to file checks ›

Activity 3: Check the copy and write your notes

What you will saveA checked working copy and a short note describing capture and the next step.

Coming back in a new PowerShell window?

Set $mrcCase = 'E:\SUSA-047' using your actual case path. The next block reads the original filename and hash from the saved record. You do not need to capture again.

1. Copy the image and compare both hashes

The original stays in memory. Use the copy in working for analysis. This block checks the original against its saved hash before copying, then checks the new copy. Large files can take several minutes to hash and copy.

$mrcRecorded = @(Import-Csv -LiteralPath "$mrcCase\image-sha256.csv")
if ($mrcRecorded.Count -ne 1) { throw 'Expected one original image hash. Check the saved record.' }
$mrcImage = $mrcRecorded[0].Path
$mrcOriginal = Get-FileHash -Algorithm SHA256 -LiteralPath $mrcImage -ErrorAction Stop
if ($mrcOriginal.Hash -ne $mrcRecorded[0].Hash) { throw 'Original differs from its saved hash. Keep the result and investigate.' }
$mrcWorking = Join-Path "$mrcCase\working" ([IO.Path]::GetFileName($mrcImage))
if (Test-Path -LiteralPath $mrcWorking) { throw 'Working copy already exists. Check it separately; do not overwrite it.' }
$mrcImageBytes = (Get-Item -LiteralPath $mrcImage).Length
if ((Get-Volume -DriveLetter E).SizeRemaining -lt ($mrcImageBytes + 1GB)) { throw 'Not enough room for the copy and notes.' }
Copy-Item -LiteralPath $mrcImage -Destination $mrcWorking -ErrorAction Stop
$mrcCopyHash = Get-FileHash -Algorithm SHA256 -LiteralPath $mrcWorking -ErrorAction Stop
[pscustomobject]@{
    Original = $mrcImage
    WorkingCopy = $mrcWorking
    RecordedSHA256 = $mrcRecorded[0].Hash
    OriginalSHA256 = $mrcOriginal.Hash
    CopySHA256 = $mrcCopyHash.Hash
    Match = $mrcCopyHash.Hash -eq $mrcRecorded[0].Hash
} | Export-Csv -LiteralPath "$mrcCase\working-copy-check.csv" -NoTypeInformation
Import-Csv -LiteralPath "$mrcCase\working-copy-check.csv" | Format-List
if ($mrcCopyHash.Hash -ne $mrcRecorded[0].Hash) { throw 'Copy does not match. Keep the comparison and resolve it before analysis.' }

Look for: Match: True and three matching hashes. They show that the recorded image, current original and working copy match. They do not show whether all RAM was captured or whether the activity was harmful.

If a copy already exists, calculate that file's SHA-256 and compare it with image-sha256.csv. Save the result without silently replacing it. If either hash differs, stop using that copy, keep the result, check the file/transfer/storage and make a new copy from the checked original when appropriate.

2. Choose your conclusion and write the handover

Check your conclusionThe capture finished and the copy's hash matches. What can you tell the next analyst?

The reported PowerShell activity was malicious.The copy matches the saved image. Next, check that an analysis tool can read it and investigate the reported activity.Every memory page was captured at the same moment.

Choose an answer, then write your note using your actual results.

Save this template as handover.txt in the case folder. Replace the prompts with your results and supporting file paths. Include problems honestly. Do not say you found Notepad or PowerShell in the image unless you opened it in an analysis tool and checked.

Case SUSA-047: save RAM for later review of the reported activity.
Operator, permission, VM name, Windows version, RAM, snapshot and time zone:
Tool filename/version, download source/date and executable SHA-256:
Evidence disk, filesystem, free space and Segment size:
Original image path, byte size and image-sha256.csv:
Capture start/finish records, completion message and screenshot:
Warnings, errors, cancellations or retry reasons:
Working-copy path and working-copy-check.csv result:
Training program: Notepad name/PID/time; deliberately started for this lab.
What I checked: saved file, original hash and working-copy hash.
What I have not checked: image readability and reported activity, unless analysed separately.
Limits: memory changes during capture; hashes do not prove all RAM was saved or activity was harmful.
Next: open the working copy in a memory-analysis tool and examine the lead with other case records.
Where the case is kept, access/transfer notes and VM reset plan:

Look for: a note telling another analyst which computer you captured, where the files are, what checks passed, what problems remain and what to do next. That is the end of the core lab.

Optional: find the training Notepad process in the saved image

On a separate analysis system, follow the Volatility and Workbench guide to prepare Volatility Workbench v3 with support for your Windows build. Use Browse Image to select the checked file from working, choose Windows as the platform, then Get Process List. Some tools need Windows symbols, which describe the structures in memory, and may download them before showing results.

Look for notepad.exe and compare its PID with notes\training-process.txt. Save the tool version, selected image path, result and errors. A matching row shows the saved memory includes that process record; it does not prove harmful activity or complete capture. The typed text is not guaranteed to be recovered by this check.

If the image cannot be read, check the file, transfer hash, Windows support and symbols before deciding another capture is needed. Add the result or unresolved error to the handover. This step is optional; keep it separate from the original/copy checks.

Finish the lab3. Keep the case before restoring the VM

Keep the evidence disk

Retain the original, working copy, hashes, screenshots, notes and failed attempts. Open the retained notes and check the saved image's hash before restoring Windows.

Close the training Notepad window and lab applications, then shut down the VM. Record where you kept the case and any transfers or access changes. Restore the clean Windows snapshot through your VM software. Check which disks the snapshot includes so you do not roll back or discard the evidence disk along with Windows.

Look for: a readable retained case and a recorded VM reset or reset plan. The page's Reset progress button only clears the browser ticks. Keep memory images in your controlled lab storage because they can contain sensitive data.

Ready to hand over I saved the copy/hash comparison and a handover stating what I checked and what remains. I checked the retained case and recorded the VM reset plan while keeping the evidence disk.Tick these after saving the records. Resolve a hash mismatch before calling the copy checked. The optional process list exercise is not required.

Finish by checking that the case includes the files listed below.

Review the saved files ›

Full Lab evidence checklist

Files to keepSave the two checkpoints in each activity.

• 1Starting detailscase-context.txt, tool-sha256.csv and notes/training-process.txt
• 2CaptureOriginal RAW in memory/, attempt notes and completion/error screenshots in notes/, image-details.csv and image-sha256.csv; keep failed attempts too
• 3Copy and handoverRAW copy in working/, working-copy-check.csv and handover.txt; explain missing records and problems

You have saved the memory, checked a copy and left notes the next analyst can use.

PreviousMagnet RAM Capture overviewPractise againReturn to the Interactive Lab