# Memory (RAM) Acquisition

Memory forensics has become the most critical component of modern Incident Response. As attackers adapt to disk forensics, they increasingly utilize "fileless" malware—malicious code that injects itself directly into the RAM of running processes and never touches the hard drive. 

If you power off the machine before extracting the RAM, that evidence evaporates instantly.

## Why RAM is the Holy Grail
A full memory dump contains a snapshot of the exact state of the system at that moment in time. It holds:
1.  **Running Processes:** Not just what the OS *thinks* is running, but what is *actually* executing in memory, including hidden rootkits.
2.  **Active Network Connections:** You can see which processes are actively talking to external IP addresses (Command & Control beacons).
3.  **Decrypted Data:** Even if the hard drive is encrypted with BitLocker, the system must hold the decryption key in RAM to function. Ram dumps routinely yield cleartext passwords, decryption keys, and private SSL keys.
4.  **Clipboard Contents:** What the user just copied and pasted.
5.  **Command History:** History of terminal commands recently run.

## Acquisition Tools
Because RAM is actively being used by the operating system, you cannot use a simple copy command to grab it. You need a specialized kernel driver to access the raw memory space.

Common free tools include:
*   **DumpIt (Windows):** A fast, simple executable. You run it from a USB drive, and it drops a `.raw` memory file onto your USB.
*   **WinPmem (Windows/Linux/Mac):** Part of the Rekall project. Powerful, scriptable, and supports the generic `.raw` format as well as the more advanced `AFF4` format.
*   **LiME (Linux):** Linux Memory Extractor. A Loadable Kernel Module (LKM) that creates a full memory capture of Linux devices.

## The Smear Effect
Memory is highly volatile and constantly changing. If a machine has 64GB of RAM, it might take 10 minutes to copy it all down to your USB drive. 

By the time the tool finishes copying the 64th gigabyte, the data in the 1st gigabyte has completely changed since the copy started. 
This results in a "smear"—the image is a patchwork of different moments in time, rather than a single frozen snapshot. Advanced memory analysis tools are designed to handle and compensate for this smear effect.

## Hibernation Files and Pagefiles
Even if a machine is powered off, you might still recover RAM data:
*   **hiberfil.sys (Hibernation File):** When a Windows laptop is put to sleep/hibernation, the OS dumps the entire contents of RAM into this file on the hard drive to save power. Extracting this file provides a perfect, frozen memory dump from the exact moment the laptop went to sleep.
*   **pagefile.sys / swapfile.sys:** When RAM gets full, the OS temporarily moves idle data from RAM onto the hard drive to free up space. Analyzing these files can reveal historical artifacts that were once in memory.