Capture RAM Using Oxygen Forensic® KeyScout

RAM (Random Access Memory) is used to temporarily store working data or code on an active computer. RAM is a snapshot of a live running system and can be captured before the system is shut down. While capturing RAM, investigators and incident responders must bear in mind that it will lead to a change in the state of the system. These changes can include:

  • Overwrite of memory for application processing.
  • KeyScout will appear in Most Recently used.

RAM analysis will give investigators and incident responders great insight into the running system processes, including processes used by malware. Overall, the contents of RAM may include the following artifacts:

  • Evidence of malware intrusion
  • Loaded DLLs
  • Loaded device drivers
  • Open registry keys
  • Command history
  • Network connections
  • Passwords to encrypted volumes and app accounts
  • Encryption keys
  • Decrypted files and keys
  • IP addresses
  • Chats, emails and internet history

To capture RAM with Oxygen Forensic® Detective, investigators will need to use the built-in Oxygen Forensic® KeyScout utility. It has the smallest possible footprint and requires no installation.

It’s important to note that maintaining a small footprint without installation helps obtain the most amount of RAM for analysis of the Windows 10 environment. This means investigators will now have access to the full scope of data with Oxygen Forensic® KeyScout.

How it’s done:

Locate Oxygen Forensic® KeyScout on the Home screen of Oxygen forensic® Detective and copy it to a USB drive.


Get The Latest DFIR News!

Join the Forensic Focus newsletter for the best DFIR articles in your inbox every month.


Unsubscribe any time. We respect your privacy - read our privacy policy.

Start Oxygen Forensic® KeyScout on a subject’s computer.

RAM dump can only be created with elevated privileges, such as Admin rights, so before proceeding, the investigator must press the Elevate button on the KeyScout Home screen.

Once you are made Admin, press the “Capture RAM” button to start capturing data.  It should be noted, the medium that will hold the data must be of sufficient size.

The utility will then prompt a screen to select the folder in which the dump will be saved.

Once a folder is chosen, RAM capture will start and the progress will be shown in the Memory tab.

The memory (RAM) dump will be created in Raw format that can later be examined by available open-source tools, like Volatility. RAM analysis will be added in a later version of Oxygen Forensic® Detective.

For more information regarding additional capabilities of Oxygen Forensic® KeyScout, read our digital brochure.

Leave a Comment

Latest Videos

Magnet Forensics' Matt Suiche on the Rise of e-Crime and Info Stealers

Forensic Focus 12th January 2023 3:00 am

Just like your current holiday shopping for last minute presents a lot of the good stuff has gone off the shelves already. You reach to the back and find the toy nobody really wanted but it’s the thought that counts, you stare down at Si and Desi’s Holiday Special 2022 podcast. 

Please join these two as they lament over the year that was, discuss all the things they didn’t do but promise they will do them next year, query whether putting a NAS in the storage of a roller door is a good idea, and finally arrive at what they’re looking forward to bringing you in the new year.

Show Notes:

Arduino PLC IDE - https://docs.arduino.cc/software/plc-ide
Mycroft Mark II (open source Alexa) - https://www.kickstarter.com/projects/aiforeveryone/mycroft-mark-ii-the-open-voice-assistant
Christa’s new blog - https://christammiller.com/
Si’s holiday reading - https://amzn.to/3iJyGrR
Desi’s holiday reading -  https://inteltechniques.com/
Strange event for the end of the year - https://www.reuters.com/world/europe/25-suspected-members-german-far-right-group-arrested-raids-prosecutors-office-2022-12-07/
Si’s wishful thinking - https://www.youtube.com/watch?v=GXnRgXclLd0
Si’s list to do before the EOY - https://intrepidcamera.co.uk/products/intrepid-4x5-camera
Desi’s list to do before EOY - https://www.wired.com/story/how-to-reset-your-phone-before-you-sell-it/
“Cleaning your office” - https://www.manfrotto.com/uk-en/vintage-collapsible-1-5-x-2-1m-ink-sage-ll-lb5720/
Conference recorder - https://amzn.to/3UBmre5
Desi’s blog - https://www.hardlyadequate.com/

Just like your current holiday shopping for last minute presents a lot of the good stuff has gone off the shelves already. You reach to the back and find the toy nobody really wanted but it’s the thought that counts, you stare down at Si and Desi’s Holiday Special 2022 podcast.

Please join these two as they lament over the year that was, discuss all the things they didn’t do but promise they will do them next year, query whether putting a NAS in the storage of a roller door is a good idea, and finally arrive at what they’re looking forward to bringing you in the new year.

Show Notes:

Arduino PLC IDE - https://docs.arduino.cc/software/plc-ide
Mycroft Mark II (open source Alexa) - https://www.kickstarter.com/projects/aiforeveryone/mycroft-mark-ii-the-open-voice-assistant
Christa’s new blog - https://christammiller.com/
Si’s holiday reading - https://amzn.to/3iJyGrR
Desi’s holiday reading - https://inteltechniques.com/
Strange event for the end of the year - https://www.reuters.com/world/europe/25-suspected-members-german-far-right-group-arrested-raids-prosecutors-office-2022-12-07/
Si’s wishful thinking - https://www.youtube.com/watch?v=GXnRgXclLd0
Si’s list to do before the EOY - https://intrepidcamera.co.uk/products/intrepid-4x5-camera
Desi’s list to do before EOY - https://www.wired.com/story/how-to-reset-your-phone-before-you-sell-it/
“Cleaning your office” - https://www.manfrotto.com/uk-en/vintage-collapsible-1-5-x-2-1m-ink-sage-ll-lb5720/
Conference recorder - https://amzn.to/3UBmre5
Desi’s blog - https://www.hardlyadequate.com/

YouTube Video UCQajlJPesqmyWJDN52AZI4Q_BhrBg5_sAKo

Si and Desi Holiday Special 2022

Forensic Focus 16th December 2022 12:00 am

This error message is only visible to WordPress admins

Important: No API Key Entered.

Many features are not available without adding an API Key. Please go to the YouTube Feed settings page to add an API key after following these instructions.

Latest Articles

Share to...