When discussing analyzing the memory of a system, there are two terms that are used interchangeably. The first is RAM. RAM is the portion of the computer internal systems where the operating system places data utilized by applications and the system hardware while that application or hardware is in use. What makes RAM different from storage is the volatile nature of the data. Often, if the system is shut off, the data will be lost.
There is a good deal of data contained within RAM at the time a system is running that is valuable in an incident investigation. These include the following:
- Running processes
- Loaded Dynamic Link Libraries(DLL)
- Open Registry Keys
- Network connections
