Capture and Verify Memory¶
Prepare the acquisition¶
Create a case specific destination on a separate controlled volume. Confirm its free space exceeds the endpoint's installed memory, record the endpoint identity and system time, and open Command Prompt as administrator.
Do not write the image back to the source volume
A memory image can be large and the acquisition changes the live system. Use an authorised destination, retain command output and stop if the source, destination or authority does not match the case plan.
Run WinPmem¶
The SUSA-052 case uses a prepared folder on the separate D: evidence volume. For the retained mini executable, run:
The legacy screenshot uses C:\Labs\memory; use the separate D: destination above for this case. Follow the syntax for your retained executable rather than assuming all WinPmem releases use the mini interface.
Watch the console for driver, access, space or write errors. Record the exact command and the acquisition start and finish times.
Confirm and preserve the output¶
After completion, confirm that WIN11-LAB.raw exists in D:\SUSA-052\memory. A RAW image can include padding for physical address gaps, so its size can exceed installed RAM. Review the acquisition messages as well as the size; neither file existence nor size alone proves complete acquisition.
This screenshot preserves the earlier lab's filename and location; record the path actually used in your case.
Record the output size, create a cryptographic hash using an approved utility, retain the acquisition log, and create a clearly labelled verified working copy for analysis. File existence alone is not sufficient validation.
Compare the same algorithm over the original saved file and its working copy. Matching saved file hashes support copy integrity; they do not establish that a changing live system was captured completely at one instant. Preserve failed or cancelled attempts and their logs, and use a fresh filename for an approved retry.
Acquisition record¶
| Record | Minimum detail |
|---|---|
| Authority | Case reference and authorised endpoint |
| Tool | WinPmem filename, release and executable hash |
| Timing | Start, finish, system time and time zone |
| Output | Path, filename, size and destination identity |
| Integrity | Hash algorithm and value |
| Limitations | Errors, warnings, delays and security tool interference |