Skip to content
Triage Investiga

Tips & Tricks: Live RAM Acquisition without Altering Swap Files

Tips & Tricks FTK Imager v4.7.1 4 Views

Tips & Tricks: Live RAM Acquisition without Altering Swap Files

Technique for running portable FTK Imager Lite via write-blocked flash drives to maintain memory volatility.

When responding to incidents on live machines, launching heavy applications will pollute volatile RAM memory.

  1. Use Portable FTK Imager Lite: Store the standalone binary on an external write-blocked USB.
  2. Run via Command Line CLI: Execute `ftkimager.exe --capture-mem` to minimize GUI memory footprint.
  3. Verify Hash Output: Check hash outputs immediately after acquisition finishes.
Back to FTK Imager Triage Investiga • Technical Documentation