Practical Windows Forensics

Memory acquisition

We discussed memory acquisition previously in volatile evidence acquisition in Chapter 3 , Volatile Data Collection. However, we now need to highlight this in a modern Windows operating system, the different security controls which forbid processes to access the whole memory, and the step which is required by any acquisition tool to acquire the system memory. This may cause a system crash and the loss of system memory, or the whole hard disk in the case of active hard disk encryption.

So, modern digital forensics acquisition tools tend to install a driver first to the operating system and then use this driver to access the system memory, which will need higher privileges on the system.