Skip to content

Understanding Memory Acquisition

Memory acquisition preserves a time bounded representation of accessible physical memory so an analyst can examine volatile system state after the live collection has finished.

What you will learn

By the end, you should be able to explain why memory is valuable, preserve an authorised collection window, plan destination capacity, document acquisition effects, and hand over a verified image for analysis.

Memory acquisition

Core concept

A memory acquisition tool reads accessible physical memory and writes it to an image. The image may contain processes, code, network state, command history, encryption material, and remnants of recently used data.

ProcessesMemory regionsConnectionsHandlesKeys and credentials

Keep in mind: Memory changes continuously. The system and acquisition tool change memory during collection, so the image can contain state from different moments (temporal smear). Record the method and collection times, and collect promptly.

01Physical memoryRAM used by the running operating system and processes02Memory imageThe acquired representation written for later analysis03Page fileDisk backed virtual memory data collected separately

Memory acquisition is not memory analysis

AcquisitionCapture volatile state and preserve collection context
AnalysisInterpret structures and artefacts in the acquired image
Process dumpCapture selected process memory rather than all accessible RAM
Hibernation fileA disk artefact created by Windows power management

Why it matters

Capture active state

Memory can show processes, threads, modules, handles, and other live structures.

Preserve connections

Socket and network structures may connect a process to recent communications.

Reveal memory only behaviour

Injected or unpacked code may be clearer in memory than in files stored on disk.

Retain transient material

Decrypted content, keys, commands, and credentials may exist only temporarily.

Capture workflow

  1. AuthoriseRecord the target, authority, investigation question, and operational constraints.
  2. PrepareChoose a trusted, compatible tool and controlled storage with room for the expected format, address gaps, logs, and any review copy.
  3. Record contextCapture system time, operating system details, tool version, and relevant live observations.
  4. Acquire and monitorRun the tool, avoid unrelated activity, and record errors or security tool interference.
  5. Verify and preserveReview tool status, errors, coverage and size; hash the image, verify a review copy, and preserve both securely with collection notes. Hash equality alone does not prove completeness.

Practice scenario

Capture RAM from a simulated laptop, check the saved copy and download a case note. Follow the blue instruction box. Use Help me when needed.

YOUR FIRST MEMORY CAPTURE · ABOUT 5 to 8 MINUTES

Save the clues inside a running laptop

A suspicious invoice triggered unusual activity on FIN-WS23. A disk scan found no suspicious program. Save RAM (the laptop’s working memory) so an analyst can investigate what was running.

Why RAM? Read the short case brief

RAM can hold running code and connection details that a disk scan misses. A saved image lets an analyst examine them later, even after the laptop restarts.

The incident lead approved this capture. The security team has already disconnected the laptop from the network and saved the earlier alert. Keep it powered on. If harmful activity resumes, the response team may need to act before collecting more evidence.

SUSA Memory CaptureTRAINING SIMULATOR

Practise here safely: no real laptop or RAM is accessed. The capture and findings are simulated. You can download a case note.

STEP 1 OF 3Click Prepare laptop.

This keeps the laptop on and saves its details for your case note.

Choose what to capture and where to save it

SOURCE LAPTOPFIN-WS23Windows 11 · 32 GiB RAM● Powered on

Capture approved. Network already isolated.

Preparation has not run yet.

SAVE MEMORY IMAGE

A memory image is the file containing the RAM you capture.

No drive selected

Choose the separate evidence drive (E:).

Case and laptop name included.

Tool settings and storage details

The simulator combines preparation into one click. For a real capture, confirm permission and the right computer; use a tested, compatible tool with the required privileges; and record the host state, clock and tool version.

Plan 40 GiB for this raw image, another 40 GiB for a copy, plus room for notes. This allows for gaps in memory addresses; actual space depends on the system and tool. E: uses NTFS, which supports large files.

Optional experiment: restart before capturing

Click Restart laptop to see why we keep it on. This ends the current attempt. Click Start over to try again.

The original live memory is still available.

Prepare the laptop, then choose where to save the image.

View collection record

Case SUSA-MA042 · training only · actions are kept until you start over or leave this page.

No actions yet.

Quality checklist

Preserve collection context

  1. 1PrepareChoose a trusted tool and adequate destination.
  2. 2RecordNote system time, state, versions, and commands.
  3. 3AcquireMinimise unrelated activity and monitor errors.
  4. 4VerifyHash, label, and secure the completed image.

!Plan for acquisition friction
Endpoint protectionDriver loadingLarge RAMSlow storageSystem instabilityTool footprint

Record failures and partial captures. Do not describe an incomplete image as complete evidence.

Choose a tool

Command line

WinPmem

Capture Windows memory with a focused command line workflow.

Graphical workflow

Magnet RAM Capture

Create a memory image through a straightforward graphical interface.

Alternative capture

Belkasoft Live RAM Capturer

Use an alternative Windows memory acquisition workflow.

Continue learning