Making complex data simple and compelling
From digital device to digital evidence
Unlock your vehicle's digital evidence potential
Forensic Analysis and Enhancement
Investigating and analyzing financial records
Gain access to the online accounts of deceased loved ones
Clear, precise evidence for a messy world
Expert reports to suit your specific needs
We can locate people anywhere
Stop worrying and learn the truth
Prevent, Detect, Respond To Cyberattacks
First response is crucial. Every minute counts.
The first response is critical to reduce liability
Detection & Removing Spyware Services
Reduce your electronic risk from digital transmittals
Find out who you are really talking to
Experienced, Confidential Services
Swift, professional incident response
Complicated cases require compelling digital facts
Find, recover and document digital evidence
Bring solid evidence before a judge
Cases can be investigated using Social Media
Divorce, custody battles, and other
Win the most important battle of your life
Everything you need
Effective Expert Witness in Court
Evidence shows who is telling the truth
Subpoena power yields strong evidence
Digital evidence can build a strong defense
Nowadays every digital forensic examiner knows that volatile data may contain lots of case relevant evidence. Such data may include such important information as remnants of different chats, webmail activities, running malware and even decryption keys for encrypted volumes.
There are a number of tools on the market capable of creating live RAM dumps, but today we are going to show you how to create a memory dump with Live RAM Capturer – a free tool developed by Belkasoft.
Let’s start. Download the tool using this link and put it to a USB flash drive. There are two versions of the product – 32-bit and 64-bit. We recommend you to have both on your drive. Choosing the right one depends on the target system.
Start the tool. You’ll see the following window:
As you can see, the driver is successfully loaded and we see physical memory page size (4096) and total physical memory size. Before starting the capture make sure there is enough free space on your flash drive. After that press “Capture!” button.
Then capturing is finished, you’ll see a new line: “Memory dump completed. Total memory dumped = *** MB”. In our case it’s 9208:
And that’s the total physical memory size! That’s it. We have captured the whole physical memory. Now we have a file with “mem” extension on our USB drive ready to be analysed with your favorite piece of digital forensic software. We usually use Belkasoft Evidence Center for memory dumps analysis.
It’s important to note that Live RAM Capturer complies all the forensic requirements of memory capturing: it operates in kernel mode, leaves the smallest footprint possible, it’s portable and uses read-only access.
Save my name, email, and website in this browser for the next time I comment.
Speak to a Specialist Now