What evidence may exist only in memory?¶
Computer memory can hold the working state of a live system: running programs, active connections, temporary credentials, encryption material and data being handled now.
Some of that information may also leave traces on disk or in provider logs. Some may disappear when a process ends, the machine crashes or power is removed. That is why recognising the possibility early matters.
Memory is the computer's current working area¶
When an application runs, the operating system loads code and data into memory so they can be used quickly. Memory changes continuously as programs start, stop and process new information.
A specialist examination of that state may reveal:
- running processes and their relationships;
- logged-in users and active sessions;
- current or recently used network connections;
- injected code or malware that is difficult to see on disk;
- temporary credentials, tokens or decrypted material;
- encryption keys needed to understand an unlocked encrypted system;
- clipboard content; and
- unsaved application data.
The value is often the relationship: which process, session and connection existed together, not an isolated fragment taken out of context.
The example can support a finding that a particular process and connection existed in the captured state. It does not by itself identify the person behind the account or prove why the process was running.
Decide whether the volatile state matters to this case¶
Memory is especially important where the live question involves malware, remote control, encryption, a running virtual system, temporary access material or work not saved elsewhere. Active sessions and processes and current network connections may also be visible through ordinary system interfaces, but those views are not a substitute for a specialist acquisition.
Do not explore memory by downloading tools or running commands on the evidential machine. Every program introduced uses memory and changes the system. Instead, preserve the visible state, power and connectivity position, then brief a specialist on the question the capture needs to answer.
A live-memory capture explains what the specialist acquisition produces.
