Full Memory Dump
Location
Acquired via live capture (RAM)Description
Complete physical memory image of the running system capturing all active processes, kernel structures, network connections, loaded DLLs, injected code, and decrypted data.
Forensic Value
Memory analysis is the only reliable method to detect fileless malware, process injection, and reflective DLL loading that leave no disk artifacts. Active network connections with owning process context, decrypted credential material from LSASS, and in-memory-only scripts are all recoverable. Volatility profiles can reconstruct the full process tree, open handles, and loaded modules.
Tools Required
Collection Commands
DumpIt
DumpIt.exe /OUTPUT C:\output\memory.dmp
WinPmem
winpmem_mini_x64.exe C:\output\memory.raw
Magnet RAM Capture
MagnetRAMCapture.exe (GUI - select output path and capture)
Volatility 3
vol.py -f memory.raw windows.pslist.PsList
Collection Constraints
- •Availability, retention, and field coverage depend on the Windows release, SKU, per-host audit policy, and user activity. Treat absence as inconclusive unless you verified the feature was enabled.
- •Live-state evidence is volatile. Collect it before reboot, containment, or power loss whenever legal and operational constraints allow.
MITRE ATT&CK Techniques
Used in Procedures
Volatile Memory Capture
preserve
Analyze Ransom Note and Variant Identification
triage
Assess Decryption Options (Backups, Keys, Tools)
recover
Document Chain of Custody for All Collected Evidence
preserve
Preserve VSS Shadow Copies and Encryption Timing Artifacts
preserve
Review Ransomware Resilience and Backup Isolation Failures
post-incident
Related Blockers
BitLocker/Encrypted Drives Preventing Forensic Imaging
Full-disk encryption (BitLocker, FileVault, LUKS) prevents mounting or imaging the drive without the recovery key. Without decryption you cannot access the filesystem for artifact collection.
Compromised Systems Powered Off or Disconnected
Key systems have been powered off by users, IT, or as part of a premature containment action. Volatile data (running processes, network connections, memory-resident malware) is lost. Remote collection tools cannot reach the host.
Systems Encrypted by Ransomware -- Normal Artifact Collection Blocked
Ransomware has encrypted the filesystem on affected hosts. Standard artifact collection tools cannot read files, registry hives, or event logs from the encrypted volume. The operating system may not boot.
Systems Already Rebooted -- Volatile Data Lost
The affected systems have already been rebooted (by users, IT, or automated patch processes) before memory could be captured. Running processes, network connections, injected code, and encryption keys that existed only in RAM are no longer recoverable.