# Memory Acquisition Methods

Guide to acquiring memory dumps from different platforms and scenarios for forensic analysis.

## Principles

1. **Minimize footprint**: Acquisition tools should leave minimal traces on the target system
2. **Verify integrity**: Always hash the dump immediately after acquisition
3. **Document chain of custody**: Record who, when, where, and how
4. **Prioritize volatile data**: Memory is volatile; acquire before disk imaging
5. **Use trusted tools**: Run acquisition from external/trusted media when possible

---

## Linux Memory Acquisition

### LiME (Linux Memory Extractor)

The gold standard for Linux memory acquisition. Kernel module that dumps physical memory.

**Installation:**
```bash
sudo apt-get install linux-headers-$(uname -r) build-essential
git clone https://github.com/504ensicslabs/LiME.git
cd LiME/src
make
```

**Usage:**
```bash
# Raw format (compatible with Volatility)
sudo insmod lime.ko "path=/evidence/memory.raw format=raw"

# LiME format (includes metadata)
sudo insmod lime.ko "path=/evidence/memory.lime format=lime"

# Padded format (includes non-accessible ranges as zeros)
sudo insmod lime.ko "path=/evidence/memory.padded format=padded"

# Network transfer (avoid writing to target disk)
sudo insmod lime.ko "path=tcp:4444 format=raw"
# On forensic workstation:
nc <target_ip> 4444 > memory.raw
```

**Formats:**
| Format | Description | Use Case |
|--------|-------------|----------|
| `raw` | Concatenated physical memory ranges | Volatility analysis |
| `lime` | Includes address space metadata | Preserves memory layout |
| `padded` | Full address space with zero-filled gaps | Maximum compatibility |

**Pros:** Forensically sound, minimal footprint, widely supported
**Cons:** Requires kernel headers to compile, needs root access

### AVML (Acquire Volatile Memory for Linux)

Microsoft's open-source memory acquisition tool. Statically compiled, no kernel headers needed.

**Installation:**
```bash
wget https://github.com/microsoft/avml/releases/latest/download/avml
chmod +x avml
sudo mv avml /usr/local/bin/
```

**Usage:**
```bash
# Basic acquisition
sudo avml memory.raw

# Compressed output
sudo avml --compress memory.raw.gz

# With upload to Azure blob storage
sudo avml --upload-url "https://storage.blob.core.windows.net/..." memory.raw
```

**Pros:** No compilation needed, single static binary, cloud upload support
**Cons:** Linux only, limited format options

### /proc/kcore

Virtual file that provides access to physical memory through the ELF core format.

```bash
sudo dd if=/proc/kcore of=/evidence/memory.raw bs=1M
```

**Pros:** No additional tools required
**Cons:** May not capture all memory regions, kernel must support it, less reliable

### /dev/mem and /dev/fmem

Direct physical memory access devices.

```bash
# /dev/mem (limited to first 1MB on modern kernels)
sudo dd if=/dev/mem of=/evidence/low_memory.raw bs=1M count=1

# /dev/fmem (third-party module for full access)
sudo dd if=/dev/fmem of=/evidence/memory.raw bs=1M
```

**Note:** Modern kernels with `CONFIG_STRICT_DEVMEM` restrict `/dev/mem` to the first 1MB.
The `fmem` module bypasses this restriction.

---

## Windows Memory Acquisition

### WinPmem

Open-source memory acquisition tool from the Velocidex project.

**Usage:**
```powershell
# Basic acquisition
winpmem_mini_x64.exe memory.raw

# With specific output format
winpmem_mini_x64.exe --format raw -o memory.raw

# Load driver and acquire
winpmem_mini_x64.exe --load-driver --format raw -o memory.raw
```

**Pros:** Open source, reliable, actively maintained
**Cons:** Requires administrator privileges, driver signing requirements

### DumpIt

Lightweight memory acquisition tool.

```powershell
# Interactive mode
DumpIt.exe

# Quiet mode with output path
DumpIt.exe /quiet /output E:\evidence\memory.raw
```

**Pros:** Very simple to use, small footprint
**Cons:** Commercial (free for personal use)

### Magnet RAM Capture

Free GUI-based memory acquisition tool.

**Usage:** Launch the GUI, select output location, click "Capture Memory."

**Pros:** User-friendly GUI, free
**Cons:** Windows only, GUI-only (no command-line automation)

### FTK Imager

Forensic imaging tool that includes memory capture.

**Usage:** File > Capture Memory > Select destination path

**Pros:** Established forensic tool, captures pagefile option
**Cons:** Larger footprint, GUI-based

### PowerShell (Limited)

```powershell
# Capture process memory (not full physical memory)
$proc = Get-Process -Id <PID>
# Use procdump or MiniDumpWriteDump API
.\procdump.exe -ma <PID> process_dump.dmp

# For full memory, use native tools above
```

---

## Virtual Machine Memory

### VMware

VMware stores guest memory in `.vmem` files when a snapshot is taken.

```bash
# Locate the .vmem file
find /path/to/vm -name "*.vmem"

# The .vmem file is a raw memory image - use directly with Volatility
vol -f /path/to/vm/snapshot.vmem windows.info

# Suspend VM to create a consistent memory state
vmrun suspend /path/to/vmx
# Then copy the .vmem file
```

**Files of interest:**
- `*.vmem`: Raw memory image
- `*.vmss`: Suspend state (includes memory)
- `*.vmsn`: Snapshot state (includes memory)

### VirtualBox

```bash
# Create a memory dump from running VM
VBoxManage debugvm "VM_Name" dumpvmcore --filename memory.elf

# Convert ELF core to raw (if needed)
volatility3 -f memory.elf <plugin>

# Alternative: Use .sav file from snapshot
VBoxManage snapshot "VM_Name" take "forensic_snapshot"
# Find .sav file in VirtualBox VMs directory
```

### Hyper-V

```powershell
# Export VM (includes memory state)
Export-VM -Name "VM_Name" -Path "E:\evidence\"

# The exported .bin file contains memory
# Convert with vm2dmp or use directly

# Checkpoint approach
Checkpoint-VM -Name "VM_Name" -SnapshotName "forensic"
# Memory saved in .vsv and .bin files
```

### KVM/QEMU

```bash
# Dump memory from running VM via QEMU monitor
virsh dump <domain> /evidence/memory.raw --memory-only

# Alternative via QEMU monitor
echo '{"execute": "dump-guest-memory", "arguments": {"paging": false, "protocol": "file:/evidence/memory.raw"}}' | \
    socat - UNIX-CONNECT:/var/run/qemu-monitor.sock

# Using virsh
virsh qemu-monitor-command <domain> --hmp "dump-guest-memory /evidence/memory.elf"
```

---

## Special Scenarios

### Hibernation File Analysis

Windows hibernation files (`hiberfil.sys`) contain a compressed memory image.

```bash
# Copy hiberfil.sys from the Windows partition
# Volatility 3 can process it directly
vol -f hiberfil.sys windows.info

# Or convert to raw first
volatility3 -f hiberfil.sys windows.hibernation.Info
```

### Crash Dump Analysis

Windows crash dumps (`.dmp`) contain memory captured during a system crash.

```bash
# Full memory dump (complete physical memory)
vol -f MEMORY.DMP windows.info

# Kernel dump (kernel memory only)
# Limited analysis possible

# Minidump (partial memory)
# Very limited, mostly for crash analysis
```

**Configure Windows for full memory dumps:**
```powershell
# Set crash dump type to Complete Memory Dump
wmic recoveros set DebugInfoType=1
# Or via registry
reg add "HKLM\SYSTEM\CurrentControlSet\Control\CrashControl" /v CrashDumpEnabled /t REG_DWORD /d 1 /f
```

### Remote Memory Acquisition

When physical access is not possible:

```bash
# Linux: LiME over network
# On target:
sudo insmod lime.ko "path=tcp:4444 format=raw"
# On forensic workstation:
nc <target_ip> 4444 > memory.raw

# Windows: F-Response or similar enterprise tools
# Provides remote block-level access to memory
```

### Cloud VM Memory

```bash
# AWS EC2: No direct memory access
# Use SSM to deploy acquisition tool, then download dump

# Azure: AVML supports Azure blob upload
sudo avml --upload-url "<sas_url>" memory.raw

# GCP: Create VM snapshot, attach to forensic VM
```

---

## Verification and Documentation

### Hash Verification

Always compute hashes immediately after acquisition:

```bash
# Linux
sha256sum memory.raw > memory.raw.sha256
md5sum memory.raw > memory.raw.md5

# Windows
certutil -hashfile memory.raw SHA256
Get-FileHash -Algorithm SHA256 memory.raw
```

### Acquisition Log Template

Document the following for each acquisition:

```
Date/Time (UTC):
Analyst:
Case ID:
Target System:
  - Hostname:
  - OS Version:
  - RAM Size:
  - Architecture:
Tool Used:
  - Name:
  - Version:
  - Hash of tool:
Output File:
  - Path:
  - Size:
  - SHA-256:
  - MD5:
Notes:
```

### Best Practices

1. **Run from external media** when possible to avoid modifying the target
2. **Save to external storage** to avoid overwriting evidence on target disk
3. **Acquire memory before disk** since memory is more volatile
4. **Document everything** including exact commands, timestamps, and any errors
5. **Verify the dump** by checking file size against expected RAM size
6. **Test your tools** beforehand on a similar system to confirm they work
7. **Consider pagefile** on Windows - capture `pagefile.sys` alongside memory
8. **Time synchronization** - note any time offset on the target system