Acquiring memory using FTK Imager

Memory is a very important source of evidence in an investigation process. All activities that happen on a system are usually reflected in the memory at the time.

The following is a step-by-step guide to acquire a system's volatile memory using the product FTK Imager.

This can be downloaded for free at http://accessdata.com/product-download.

1. Run FTK Imager as an administrator, as shown in the following screenshot:

   

2. Click on the File menu and select Capture Memory, as shown in the following screenshot:

   

3. Browse the destination folder, where you want to save the acquired memory dump, as shown in the following screenshot:

   

4. Click on Browse and create a destination folder, as shown in the following screenshot:

   

5. After creating the destination folder, click on Capture Memory, as shown in the following screenshot:

   

6. Click on Capture Memory and the memory dumping will start, as shown in the following screenshot:

   

7. Creation of pagefile starts after the completion of memory dump,...