# Memory Acquisition

## Live System Memory acquisition:

[WinPMEM](https://github.com/velocidex/c-aff4/releases)\
[MagnetForensicsRamCapture](https://magnetforensics.com/free-tool-magnet-ram-capture)\
[Belkasoft Live Ram Capture](https://forensic.belkasoft.com/en/ram-capture)\
[F-Response](https://www.f-response.com)\
[FTKImager](https://www.exterro.com/ftk-product-downloads)

## Pagefile.sys

modern systems built around virtual and paged memory. page files are heavily used on systems with lots of ram as a collection of data from the memory (overflow/ not immediate short term memory)&#x20;

## Dead System Memory Acquisition:&#x20;

```powershell
# Hibernation File: 
%SystemDrive%\hiberfil.sys

# Page and Swap files: 
%SystemDrive%\PageFile.sys
%SystemDrive%\SwapFile.sys #(Win8+/2012+)
### Reg Key
SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management

# Kernel memory dumps: 
%SystemRoot%\MEMORY.DMP
### Registry key to set: 
SYSTEM\CurrentControlSet\Control\CrashControl
```

### Hibernation File:&#x20;

Created on file hibernation and is a copy of the RAM at the time of system hibernation.&#x20;

Conversion can be done automatically in [MemProcFS ](../tooling/memprocfs)or [Volatility ](../tooling/volatility)(1/2), optionally using the [Hibr2bin](https://github.com/MagnetForensics/Hibr2Bin) executable. Other tools include: [Axiom](https://www.magnetforensics.com/products/magnet-axiom/?utm_source=Google\&utm_medium=Search\&utm_campaign=2024_AXIOM_Google_ads\&utm_source=Google\&utm_medium=Search\&utm_campaign=2023_AXIOM_productpage\&gad_source=1\&gclid=CjwKCAjw0YGyBhByEiwAQmBEWkAF0Mv8uVmJ5iQQCcKgRSCTTDsKMHW8M8A5CGvRVLhDk2MdpgUpuBoCB7IQAvD_BwE), [BulkExtractor](../../forensics/forensics-tooling/bulkextractor-and-bulkextractor-rec), [Belkasoft Evidence Centre](https://belkasoft.com/es/ec?utm_term=\&utm_campaign=Belkasoft+Evidence+Center+X\&utm_source=adwords\&utm_medium=ppc\&hsa_acc=9976381333\&hsa_cam=15354488620\&hsa_grp=146063170264\&hsa_ad=612093065895\&hsa_src=g\&hsa_tgt=dsa-1748386367247\&hsa_kw=\&hsa_mt=\&hsa_net=adwords\&hsa_ver=3\&gad_source=1\&gclid=CjwKCAjw0YGyBhByEiwAQmBEWhOWU9QY-VHu-CJx6K-hBU9u_bJ_Q2V_-ZKcg_qmY-hdtVi9UIH3iRoCB_gQAvD_BwE) and [PassWare](https://www.passware.com/)
