Capture Tools

Capture Tools

Assignment link

1. FTK Imager
2. Dumpit
3. Magnet RAM Capture

Notes

• Page files in Windows Systems
• These are hidden Windows system files on the hard disk that act as an extension of the physical RAM/Virtual Memory
• Notes that even if we were not able to capture the volatile data, page files can be obtained via disk acquisition since they reside on the disk
• Crash Dumps
• If system goes to reboot for some reason during the acquisition process, part of the volatile data can be obtained from the hard disk through crash dumps