## Memory Acquisition Techniques

Taking a "picture" of RAM is trickier than disk.

### 1. Hardware-Based Acquisition (DMA)
*   **FireWire / Thunderbolt**: These ports have Direct Memory Access (DMA).
*   **Method**: Plug in a specialized device. It can read RAM directly without the CPU even knowing.
*   **Pros**: Undetectable by malware.
*   **Cons**: Requires physical ports; modern OS protections (DMA Mapping) often block this.

### 2. Software-Based Acquisition (Kernel Driver)
*   **Method**: Run a tool (Administrator privileges required) that loads a Kernel Driver to read physical memory.
*   **Tools**:
    *   **WinPMEM**: Part of the Rekall framework.
    *   **DumpIt**: Simple, one-click dumper.
    *   **FTK Imager**: GUI-based.
*   **Risk**: Loading a driver *changes* the memory you are trying to measure (Heisenberg Uncertainty Principle). It might trigger a Blue Screen of Death (BSOD) if the system is unstable.

### 3. Virtual Machine Snapshots
*   If the target is a VM (VMware/Hyper-V), you are lucky.
*   **Method**: Just take a Snapshot "with memory".
*   **File**: `.vmem` file. This is a perfect, uncorrupted copy of the RAM. No tools needed on the guest.

### The Hyberfil.sys file
*   When a laptop hibernates (sleeps), Windows writes the entire contents of RAM to `C:hiberfil.sys`.
*   **Forensic Gold**: You can convert this file into a raw memory image and analyze it, even if the computer is currently off.