Magnet RAM Capture is a free imaging tool designed to capture the physical memory of a suspect’s computer, allowing investigators to recover and analyze valuable artifacts that are often only found in memory.
Magnet RAM Capture has a small memory footprint, meaning investigators can run the tool while minimizing the data that is overwritten in memory. Export captured memory data in Raw (.DMP) format and easily upload into leading analysis tools including, Internet Evidence Finder.
Evidence that can be found in RAM includes process and programs running on the system, network connections, evidence of malware intrusion, registry hives, username and passwords, decrypted files and keys, and evidence of activity not typically stored on the local hard disk.
Operating Systems Supported
- Windows XP, Vista, 7, 8, 10, 2003, 2008, 2012 (32 and 64 bit support)