{"id":14871,"date":"2021-11-01T00:00:00","date_gmt":"2021-11-01T00:00:00","guid":{"rendered":"https:\/\/adfsolutions.com\/collect-ram-live-computer\/"},"modified":"2026-03-11T14:15:23","modified_gmt":"2026-03-11T14:15:23","slug":"collect-ram-live-computer","status":"publish","type":"post","link":"https:\/\/adfsolutions.com\/collect-ram-live-computer\/","title":{"rendered":"Collect RAM on a Live Computer"},"content":{"rendered":"\n<p>When conducting <a href=\"\/digital-forensics\" rel=\" noopener\">digital forensic<\/a> investigations that involve live (up and running) computers, it is imperative to collect volatile memory so that all your bases covered and so that no vital evidence is lost.&nbsp; A live analysis conducted in the correct manner will yield the results you are looking for in your investigation.&nbsp; It has become commonplace and an accepted practice to collect data from a live computer, especially in cases of child exploitation. ADF software makes it easy for detectives and investigators to perform a <a href=\"\/news\/ram-capture\" rel=\" noopener\">RAM capture<\/a> in the proper manner with as little intrusion as possible.<!--more--><\/p>\n<video width=\"100%\" controls>\n  <source src=\"https:\/\/4330725.fs1.hubspotusercontent-na1.net\/hubfs\/4330725\/RAM%202021.mp4\" type=\"video\/mp4\">\n<\/video>\n<p>The first order of business should be the volatile data or collecting the RAM.&nbsp; ADF has simplified the process and will expeditiously and efficiently collect the volatile data first. Once the RAM collection is saved to the collection key and completed you can next go right to the scanning of the drives, partitions, or attached devices for relevant and actionable evidence. This will allow you to make critical on-scene decisions.<\/p>\n<p>As with any tool used for live analysis, ADF will access files on the target computer while scanning. ADF will access files on the target computer without modifying their timestamps. However, it should be expected that running ADF&nbsp;software on a live system will leave traces related to the insertion of both the Collection Key and Authentication Key and the execution of the application. (See <a href=\"\/technical-specifications\" rel=\" noopener\">Technical Specifications<\/a> Sect.3)<\/p>\n<p>When returning to the forensic lab, or within your mobile lab, RAM dumps can be analyzed with the appropriate software (e.g. Volatility).<\/p>\n<p>The collection key will serve several purposes in the field and while on-scene:<\/p>\n<ol style=\"font-size: 18px;\">\n<li>RAM Collection \u2013 First option when executing the application<\/li>\n<li>Scanning and collection of relevant data<\/li>\n<li>Imaging of drive and attached devices<\/li>\n<li>Analysis on scene or back at the lab<\/li>\n<\/ol>\n<p>These options are independent of each other and do not all need to be run on every computer. The tool can be used to conduct just one task. As always with ADF\u2019s <a href=\"\/\" rel=\" noopener\">computer forensics<\/a> flexible licensing you can&nbsp;collect RAM, scan for information and evidence, or image many computers simultaneously.<\/p>\n<p><a class=\"optech-default-btn btn-style cta_button\" href=\"https:\/\/cta-redirect.hubspot.com\/cta\/redirect\/4330725\/668f96ee-04cf-4714-a55b-42124601ef89\" target=\"_blank\" data-text=\"Talk to an ADF Expert\"><span class=\"btn-wraper\">Talk to an ADF Expert<\/span><\/a><\/p>\n<p>Empower your team to perform computer evidence collection on-scene with <a href=\"\/field-investigator-teams\" rel=\" noopener\">Field Investigator for Teams<\/a>.&nbsp;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>When conducting digital forensic investigations that involve live (up and running) computers, it is imperative to collect volatile memory so that all your bases covered and so that no vital evidence is lost.&nbsp; A live analysis conducted in the correct manner will yield the results you are looking for in your investigation.&nbsp; It has become&#8230;<\/p>\n","protected":false},"author":3,"featured_media":13257,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"content-type":"","footnotes":""},"categories":[63,283],"tags":[96,74,120,76,97,99,100,143],"class_list":["post-14871","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news","category-video","tag-computer-forensics-video","tag-digital-evidence-investigator","tag-digital-media-investigator","tag-early-case-assessment","tag-forensic-analysis","tag-how-to-video","tag-ram-capture","tag-triage-investigator","optech-blog blog-single"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.1.1 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Collect RAM on a Live Computer - ADF Solutions<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/adfsolutions.com\/collect-ram-live-computer\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Collect RAM on a Live Computer - ADF Solutions\" \/>\n<meta property=\"og:description\" content=\"When conducting digital forensic investigations that involve live (up and running) computers, it is imperative to collect volatile memory so that all your bases covered and so that no vital evidence is lost.&nbsp; A live analysis conducted in the correct manner will yield the results you are looking for in your investigation.&nbsp; It has become...\" \/>\n<meta property=\"og:url\" content=\"https:\/\/adfsolutions.com\/collect-ram-live-computer\/\" \/>\n<meta property=\"og:site_name\" content=\"ADF Solutions\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/adfsolutions\" \/>\n<meta property=\"article:published_time\" content=\"2021-11-01T00:00:00+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-03-11T14:15:23+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/adfsolutions.com\/wp-content\/uploads\/2026\/01\/Blog-Post-27-1.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1600\" \/>\n\t<meta property=\"og:image:height\" content=\"900\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Richard T. Frawley\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@adfsolutions\" \/>\n<meta name=\"twitter:site\" content=\"@adfsolutions\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Richard T. Frawley\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/adfsolutions.com\/collect-ram-live-computer\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/adfsolutions.com\/collect-ram-live-computer\/\"},\"author\":{\"name\":\"Richard T. Frawley\",\"@id\":\"https:\/\/adfsolutions.com\/#\/schema\/person\/f7fc6bb598702f2c7fd213ae40c2ac39\"},\"headline\":\"Collect RAM on a Live Computer\",\"datePublished\":\"2021-11-01T00:00:00+00:00\",\"dateModified\":\"2026-03-11T14:15:23+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/adfsolutions.com\/collect-ram-live-computer\/\"},\"wordCount\":381,\"publisher\":{\"@id\":\"https:\/\/adfsolutions.com\/#organization\"},\"image\":{\"@id\":\"https:\/\/adfsolutions.com\/collect-ram-live-computer\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/adfsolutions.com\/wp-content\/uploads\/2026\/01\/Blog-Post-27-1.png\",\"keywords\":[\"Computer Forensics Video\",\"Digital Evidence Investigator\",\"Digital Media Investigator\",\"Early Case Assessment\",\"Forensic Analysis\",\"How To Video\",\"RAM Capture\",\"Triage-Investigator\"],\"articleSection\":[\"News\",\"Video\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/adfsolutions.com\/collect-ram-live-computer\/\",\"url\":\"https:\/\/adfsolutions.com\/collect-ram-live-computer\/\",\"name\":\"Collect RAM on a Live Computer - ADF Solutions\",\"isPartOf\":{\"@id\":\"https:\/\/adfsolutions.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/adfsolutions.com\/collect-ram-live-computer\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/adfsolutions.com\/collect-ram-live-computer\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/adfsolutions.com\/wp-content\/uploads\/2026\/01\/Blog-Post-27-1.png\",\"datePublished\":\"2021-11-01T00:00:00+00:00\",\"dateModified\":\"2026-03-11T14:15:23+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/adfsolutions.com\/collect-ram-live-computer\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/adfsolutions.com\/collect-ram-live-computer\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/adfsolutions.com\/collect-ram-live-computer\/#primaryimage\",\"url\":\"https:\/\/adfsolutions.com\/wp-content\/uploads\/2026\/01\/Blog-Post-27-1.png\",\"contentUrl\":\"https:\/\/adfsolutions.com\/wp-content\/uploads\/2026\/01\/Blog-Post-27-1.png\",\"width\":1600,\"height\":900},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/adfsolutions.com\/collect-ram-live-computer\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/adfsolutions.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Collect RAM on a Live Computer\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/adfsolutions.com\/#website\",\"url\":\"https:\/\/adfsolutions.com\/\",\"name\":\"ADF Solutions\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\/\/adfsolutions.com\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/adfsolutions.com\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/adfsolutions.com\/#organization\",\"name\":\"ADF Solutions\",\"url\":\"https:\/\/adfsolutions.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/adfsolutions.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/adfsolutions.com\/wp-content\/uploads\/2026\/01\/favicon.png\",\"contentUrl\":\"https:\/\/adfsolutions.com\/wp-content\/uploads\/2026\/01\/favicon.png\",\"width\":512,\"height\":512,\"caption\":\"ADF Solutions\"},\"image\":{\"@id\":\"https:\/\/adfsolutions.com\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/adfsolutions\",\"https:\/\/x.com\/adfsolutions\",\"https:\/\/www.linkedin.com\/company\/adf-solutions\/\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/adfsolutions.com\/#\/schema\/person\/f7fc6bb598702f2c7fd213ae40c2ac39\",\"name\":\"Richard T. Frawley\",\"url\":\"https:\/\/adfsolutions.com\/author\/richardtfrawley\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Collect RAM on a Live Computer - ADF Solutions","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/adfsolutions.com\/collect-ram-live-computer\/","og_locale":"en_US","og_type":"article","og_title":"Collect RAM on a Live Computer - ADF Solutions","og_description":"When conducting digital forensic investigations that involve live (up and running) computers, it is imperative to collect volatile memory so that all your bases covered and so that no vital evidence is lost.&nbsp; A live analysis conducted in the correct manner will yield the results you are looking for in your investigation.&nbsp; It has become...","og_url":"https:\/\/adfsolutions.com\/collect-ram-live-computer\/","og_site_name":"ADF Solutions","article_publisher":"https:\/\/www.facebook.com\/adfsolutions","article_published_time":"2021-11-01T00:00:00+00:00","article_modified_time":"2026-03-11T14:15:23+00:00","og_image":[{"width":1600,"height":900,"url":"https:\/\/adfsolutions.com\/wp-content\/uploads\/2026\/01\/Blog-Post-27-1.png","type":"image\/png"}],"author":"Richard T. Frawley","twitter_card":"summary_large_image","twitter_creator":"@adfsolutions","twitter_site":"@adfsolutions","twitter_misc":{"Written by":"Richard T. Frawley","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/adfsolutions.com\/collect-ram-live-computer\/#article","isPartOf":{"@id":"https:\/\/adfsolutions.com\/collect-ram-live-computer\/"},"author":{"name":"Richard T. Frawley","@id":"https:\/\/adfsolutions.com\/#\/schema\/person\/f7fc6bb598702f2c7fd213ae40c2ac39"},"headline":"Collect RAM on a Live Computer","datePublished":"2021-11-01T00:00:00+00:00","dateModified":"2026-03-11T14:15:23+00:00","mainEntityOfPage":{"@id":"https:\/\/adfsolutions.com\/collect-ram-live-computer\/"},"wordCount":381,"publisher":{"@id":"https:\/\/adfsolutions.com\/#organization"},"image":{"@id":"https:\/\/adfsolutions.com\/collect-ram-live-computer\/#primaryimage"},"thumbnailUrl":"https:\/\/adfsolutions.com\/wp-content\/uploads\/2026\/01\/Blog-Post-27-1.png","keywords":["Computer Forensics Video","Digital Evidence Investigator","Digital Media Investigator","Early Case Assessment","Forensic Analysis","How To Video","RAM Capture","Triage-Investigator"],"articleSection":["News","Video"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/adfsolutions.com\/collect-ram-live-computer\/","url":"https:\/\/adfsolutions.com\/collect-ram-live-computer\/","name":"Collect RAM on a Live Computer - ADF Solutions","isPartOf":{"@id":"https:\/\/adfsolutions.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/adfsolutions.com\/collect-ram-live-computer\/#primaryimage"},"image":{"@id":"https:\/\/adfsolutions.com\/collect-ram-live-computer\/#primaryimage"},"thumbnailUrl":"https:\/\/adfsolutions.com\/wp-content\/uploads\/2026\/01\/Blog-Post-27-1.png","datePublished":"2021-11-01T00:00:00+00:00","dateModified":"2026-03-11T14:15:23+00:00","breadcrumb":{"@id":"https:\/\/adfsolutions.com\/collect-ram-live-computer\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/adfsolutions.com\/collect-ram-live-computer\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/adfsolutions.com\/collect-ram-live-computer\/#primaryimage","url":"https:\/\/adfsolutions.com\/wp-content\/uploads\/2026\/01\/Blog-Post-27-1.png","contentUrl":"https:\/\/adfsolutions.com\/wp-content\/uploads\/2026\/01\/Blog-Post-27-1.png","width":1600,"height":900},{"@type":"BreadcrumbList","@id":"https:\/\/adfsolutions.com\/collect-ram-live-computer\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/adfsolutions.com\/"},{"@type":"ListItem","position":2,"name":"Collect RAM on a Live Computer"}]},{"@type":"WebSite","@id":"https:\/\/adfsolutions.com\/#website","url":"https:\/\/adfsolutions.com\/","name":"ADF Solutions","description":"","publisher":{"@id":"https:\/\/adfsolutions.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/adfsolutions.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/adfsolutions.com\/#organization","name":"ADF Solutions","url":"https:\/\/adfsolutions.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/adfsolutions.com\/#\/schema\/logo\/image\/","url":"https:\/\/adfsolutions.com\/wp-content\/uploads\/2026\/01\/favicon.png","contentUrl":"https:\/\/adfsolutions.com\/wp-content\/uploads\/2026\/01\/favicon.png","width":512,"height":512,"caption":"ADF Solutions"},"image":{"@id":"https:\/\/adfsolutions.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/adfsolutions","https:\/\/x.com\/adfsolutions","https:\/\/www.linkedin.com\/company\/adf-solutions\/"]},{"@type":"Person","@id":"https:\/\/adfsolutions.com\/#\/schema\/person\/f7fc6bb598702f2c7fd213ae40c2ac39","name":"Richard T. Frawley","url":"https:\/\/adfsolutions.com\/author\/richardtfrawley\/"}]}},"_links":{"self":[{"href":"https:\/\/adfsolutions.com\/wp-json\/wp\/v2\/posts\/14871","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/adfsolutions.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/adfsolutions.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/adfsolutions.com\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/adfsolutions.com\/wp-json\/wp\/v2\/comments?post=14871"}],"version-history":[{"count":2,"href":"https:\/\/adfsolutions.com\/wp-json\/wp\/v2\/posts\/14871\/revisions"}],"predecessor-version":[{"id":16428,"href":"https:\/\/adfsolutions.com\/wp-json\/wp\/v2\/posts\/14871\/revisions\/16428"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/adfsolutions.com\/wp-json\/wp\/v2\/media\/13257"}],"wp:attachment":[{"href":"https:\/\/adfsolutions.com\/wp-json\/wp\/v2\/media?parent=14871"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/adfsolutions.com\/wp-json\/wp\/v2\/categories?post=14871"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/adfsolutions.com\/wp-json\/wp\/v2\/tags?post=14871"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}