WinPMem
If you're not using an EDR or similar tool to streamline acquisition, consider using something like Belkasoft's RAM capture or WinPmem.
Official site; https://winpmem.velocidex.com/
From elevated command prompt;
Default is to acquire as AFF4 which is a compressed container.
Reference; https://schatzforensic.com/insideout/2017/03/aff4-standard-v1-0-released/ https://github.com/aff4 http://www2.aff4.org/
C3A contains system files and drivers acquired during memory acquisition (to support analysis) PhysicalMemory is the physical memory stream container.description contains AFF4 container GUID information.turtle contains AFF4 stream data (drivers, physical memory, etc) version.txt contains information relating to version of winpmem which was executed.
Last updated
Was this helpful?