Why physical memory matters as much as the disk in forensic work
Traditional digital forensics grew up around the disk: image the drive, analyse the file system, recover what was deleted. That approach misses an entire category of evidence that only ever exists in a running system's memory, and disappears the moment the machine is powered off.
What only lives in RAM
Encryption keys that protect a disk volume, decrypted credentials an application is actively using, network connections a process has open, and malware that deliberately avoids writing itself to disk can all exist only in memory. A disk image taken after the fact will not contain any of it, because none of it was ever stored there in the first place. For an investigation into live compromise, this is often where the most direct evidence sits.
Why capture is the hard part
Unlike a disk, memory changes constantly and is lost entirely on power-down, so acquisition has to happen on a live, running system without disturbing the very evidence being collected. The order of operations matters: a memory capture is generally taken before a system is powered off for disk imaging, and the capture tool itself inevitably uses a small amount of memory, which has to be accounted for when interpreting the result.
What analysis looks for
Once captured, a memory image is examined for running processes and their loaded modules, open network connections, injected code that was never written to disk, and credentials or keys held in a process's working memory. Correlating what is found there against what the disk shows often answers questions a disk image alone cannot, such as whether a process actually executed and what it did while running, rather than just what files it left behind.
The lasting lesson
Any investigation that stops at the disk is only looking at part of the system's history. Memory capture has become a standard, early step in serious incident response precisely because so much of what happens during a live compromise never touches permanent storage at all.
Key takeaways
- Encryption keys, decrypted credentials and memory-resident malware often never touch the disk at all.
- Memory capture must happen on a live system, before power-down destroys the evidence.
- The order of operations matters: memory is generally captured before the disk is imaged.
- Memory analysis can show what a process actually did while running, not just what files it left behind.
- A forensic investigation that only examines the disk misses an entire category of volatile evidence.
This note has been rewritten and checked for this edition; it is not a copy of the original post.