FTK Imager

Access Data's FTK Imager is a Windows software platform that performs a variety of imaging tasks including acquiring the running memory of a system. The software can be downloaded at http://accessdata.com/product-download/digital-forensics/ftk-imager-version-3.4.3. Once downloaded, install the executable in the Tools partition of the USB drive. Open the FTK Imager folder and run the executable as administrator. The following window will appear:

Click on File and then on Capture Memory. This opens up the following window:

Browse to ...

Get Digital Forensics and Incident Response now with O’Reilly online learning.

O’Reilly members experience live online training, plus books, videos, and digital content from 200+ publishers.