Tips & Tricks: Best Practices for Running Magnet RAM Capture Without Compromising Evidence
Essential guide and best practices for using Magnet RAM Capture to ensure smooth memory acquisition without compromising digital evidence integrity on the target system.
In handling Live Forensics, caution is key. Running applications directly on the suspect's computer poses the risk of altering data (footprint). Here are tips and tricks to minimize system changes and ensure successful RAM extraction using Magnet RAM Capture:
1. Execute from External USB Drive
Jangan pernah mengunduh, menginstal, or menyalin file MagnetRAMCapture.exe langsung ke penyimpanan lokal komputer target becomes Never download, install, or copy the MagnetRAMCapture.exe file directly to the target computer's local storage. Always plug in the investigator's USB Flash Drive and run the application directly (portable) from the USB.
2. Save Dump Results (Output) to External Drive
Saat memilih Destination path, pastikan Anda mengarahkan lokasi penyimpanan file .RAW kembali ke USB atau harddisk eksternal Anda becomes When selecting the Destination path, ensure you direct the storage location of the .RAW file back to your USB or external hard drive.
3. Consider the USB System Format (exFAT/NTFS) Mengingat kapasitas RAM komputer saat ini sangat besar (8GB, 16GB, hingga 32GB), pastikan USB Flash Drive atau HDD Eksternal Anda diformat menggunakan exFAT atau NTFS becomes Considering the large RAM capacity of today's computers (8GB, 16GB, to 32GB), ensure your USB Flash Drive or external HDD is formatted using exFAT or NTFS.
4. Must Run as Administrator
Aplikasi membutuhkan akses tingkat rendah (low-level access) ke perangkat keras becomes The application requires low-level access to hardware. Selalu jalankan aplikasi dengan cara klik kanan pada file .exe dan pilih "Run as administrator" becomes Always run the application by right-clicking on the .exe file and selecting "Run as administrator".
5. Standardize File Naming Untuk memudahkan dokumentasi Chain of Custody (Rantai Komando Barang Bukti), gunakan format penamaan file yang standar becomes To facilitate Chain of Custody documentation, use a standard file naming format.
(
Contoh: KasusA_LaptopTersangka_RAM16GB_24052024.raw) becomes (Example: CaseA_SuspectLaptop_RAM16GB_24052024.raw)