Should an investigator attempt a live-memory capture?¶

An investigator should not attempt a live-memory capture unless trained, authorised, equipped and operating within an approved process.

Why this matters¶

The dangerous assumption is that running a memory tool is a low-risk way to preserve evidence before shutdown. The tool itself changes memory, creates records and can destabilise the system.

What to record and do¶

An incorrect capture may fail, overwrite useful data, expose the investigating media to malware or create uncertainty about what was collected.

The system may also be encrypted, remotely accessed, business-critical or connected to other services.

Before considering capture, record the screen, open applications, active connections, accounts, power and visible alerts.

Seek specialist digital-forensics or incident-response support.

Explain why memory may matter: active malware, encryption keys, remote sessions, unsaved data, live connections or temporary credentials.

Do not download an unfamiliar tool and improvise because the computer is unlocked.

If urgent operational necessity requires action before a specialist arrives, focus on preserving the visible state and controlling unnecessary interaction.

Where a trained local procedure exists, follow it exactly and record the tool, operator, time, destination and any deviation.

Memory capture does not replace disk acquisition, provider records or wider evidence preservation.

If no capture is made, document why and what live evidence was observed before power state changed.

Record whether approved capture tools, sterile destination media and a trained operator are actually available. The fact that memory may be useful does not justify introducing an uncontrolled tool or connecting unknown media to a live system.

Operational takeaway¶

Do not improvise live-memory capture; use trained, authorised specialist processes and preserve the visible live state while support is obtained.