Tools · Incident response playbooks · 09 / 20
Acquiring memory safely: WinPmem, DumpIt, AVML, and cloud VM options
Choose a memory acquisition tool for Windows, Linux, or a cloud VM, capture RAM to external storage, verify the image, and avoid common mistakes that ruin the capture.
Why memory
Memory holds running processes, network connections, decrypted data, injected code, and command history that may never touch disk. Once a system is rebooted or powered off, it is gone. Acquire memory before isolating with a shutdown, and preferably before running many other tools that change it.
Tools by platform
Windows: WinPmem (open source) and Magnet DumpIt write a raw image. Linux: AVML from Microsoft writes a LiME-format image without a kernel module; LiME uses a kernel module built for the exact kernel. Virtual machines: hypervisor snapshots can include memory, such as a VMware snapshot with memory producing a .vmem file. Cloud: some providers support memory capture through agents or hibernation-based snapshots; otherwise run the in-guest tool through the provider’s remote command feature.
Lab: capture and verify
On a Windows lab VM, run WinPmem as administrator and write to an attached external disk. On a Linux lab VM, run AVML to a mounted volume. Hash both images, record the system’s time and OS build, and test that Volatility 3 can read them with a basic plugin such as windows.info or linux.pslist.
# Windows (elevated) winpmem_mini_x64.exe E:\case\mem.raw Get-FileHash E:\case\mem.raw -Algorithm SHA256 # Linux sudo ./avml /mnt/ir/mem.lime sha256sum /mnt/ir/mem.lime; uname -a > /mnt/ir/kernel.txt # verify readability vol -f mem.raw windows.info vol -f mem.lime linux.pslist
Mistakes to avoid
Writing the image to the suspect system’s own disk, which overwrites deleted evidence. Running the tool from a network share that requires extra drivers or credentials on the host. Forgetting the image size equals RAM size, so the destination must have space. Not recording the time and OS version, which are needed for analysis.
Diagram
Poor versus good memory capture
Small habits decide whether the image is usable.
Destination. C:\ on the suspect host
Metadata. None recorded
Verification. Not checked
Destination. External or network storage
Metadata. Time, OS build, kernel, collector
Verification. Hashed and test-read with Volatility
Check yourself
1. Which tool acquires Linux memory without building a kernel module?
2. Where should a memory image be written?
3. How can you quickly confirm an image is usable?