Capture RAM Using Oxygen Forensic® KeyScout

RAM (Random Access Memory) is used to temporarily store working data or code on an active computer. RAM is a snapshot of a live running system and can be captured before the system is shut down. While capturing RAM, investigators and incident responders must bear in mind that it will lead to a change in the state of the system. These changes can include:

  • Overwrite of memory for application processing.
  • KeyScout will appear in Most Recently used.

RAM analysis will give investigators and incident responders great insight into the running system processes, including processes used by malware. Overall, the contents of RAM may include the following artifacts:

  • Evidence of malware intrusion
  • Loaded DLLs
  • Loaded device drivers
  • Open registry keys
  • Command history
  • Network connections
  • Passwords to encrypted volumes and app accounts
  • Encryption keys
  • Decrypted files and keys
  • IP addresses
  • Chats, emails and internet history

To capture RAM with Oxygen Forensic® Detective, investigators will need to use the built-in Oxygen Forensic® KeyScout utility. It has the smallest possible footprint and requires no installation.

It’s important to note that maintaining a small footprint without installation helps obtain the most amount of RAM for analysis of the Windows 10 environment. This means investigators will now have access to the full scope of data with Oxygen Forensic® KeyScout.

How it’s done:

Locate Oxygen Forensic® KeyScout on the Home screen of Oxygen forensic® Detective and copy it to a USB drive.

Get The Latest DFIR News

Join the Forensic Focus newsletter for the best DFIR articles in your inbox every month.

Unsubscribe any time. We respect your privacy - read our privacy policy.

Start Oxygen Forensic® KeyScout on a subject’s computer.

RAM dump can only be created with elevated privileges, such as Admin rights, so before proceeding, the investigator must press the Elevate button on the KeyScout Home screen.

Once you are made Admin, press the “Capture RAM” button to start capturing data.  It should be noted, the medium that will hold the data must be of sufficient size.

The utility will then prompt a screen to select the folder in which the dump will be saved.

Once a folder is chosen, RAM capture will start and the progress will be shown in the Memory tab.

The memory (RAM) dump will be created in Raw format that can later be examined by available open-source tools, like Volatility. RAM analysis will be added in a later version of Oxygen Forensic® Detective.

For more information regarding additional capabilities of Oxygen Forensic® KeyScout, read our digital brochure.

Leave a Comment

Latest Videos

Digital Forensics News Round-Up, June 19 2024 #dfir #digitalforensics

Forensic Focus 19th June 2024 2:46 pm

Digital Forensics News Round-Up, June 19 2024 #dfir #digitalforensics

Forensic Focus 19th June 2024 2:14 pm

Digital Forensics News Round-Up, June 12 2024 #dfir #digitalforensics

Forensic Focus 12th June 2024 5:51 pm

This error message is only visible to WordPress admins

Important: No API Key Entered.

Many features are not available without adding an API Key. Please go to the YouTube Feeds settings page to add an API key after following these instructions.

Latest Articles