Memory Dump
Memory Dump
Speicherabbild
A memory dump is a snapshot of a system's memory (RAM) at a particular moment. It contains what was active at runtime: processes, loaded modules, network connections, decrypted data and at times malicious code. It is the basis of memory forensics and often the key to fileless attacks.
History & facts. Because many traces exist exclusively in memory and disappear on shutdown, the memory image is a particularly valuable but volatile artefact. It is taken during operation and then analysed with specialised tools such as Volatility, which reconstruct from it processes, connections and hidden code. Decrypted content and keys held in memory can become visible here that cannot be found on the data carrier.
Outlook & recommendation. In the order of volatility, memory ranks at the very top: its acquisition should occur before the disk image. Those who reflexively switch off a suspicious system often destroy the most important evidence. Taking a memory image alters the system minimally — this unavoidable change becomes manageable through a documented, restrained approach. The memory image is thus the central piece of evidence of live forensics.