MAGNET RAM Capture

MAGNET RAM Capture is a free imaging tool designed to capture the physical memory of a suspect’s computer, allowing investigators to recover and analyze valuable artifacts that are often only found in memory.

MAGNET RAM Capture has a small memory footprint, meaning investigators can run the tool while minimizing the data that is overwritten in memory. You can export captured memory data in Raw (.DMP/.RAW/.BIN) format and easily upload into leading analysis tools including Magnet AXIOM and Magnet IEF.

Evidence that can be found in RAM includes processes and programs running on the system, network connections, evidence of malware intrusion, registry hives, usernames and passwords, decrypted files and keys, and evidence of activity not typically stored on the local hard disk.