{"id":15005,"date":"2018-04-20T00:00:00","date_gmt":"2018-04-20T00:00:00","guid":{"rendered":"https:\/\/adfsolutions.com\/ram-capture\/"},"modified":"2026-02-18T13:29:41","modified_gmt":"2026-02-18T13:29:41","slug":"ram-capture","status":"publish","type":"post","link":"https:\/\/adfsolutions.com\/ram-capture\/","title":{"rendered":"Don&#8217;t Forget RAM Capture: A Key to Digital Forensics"},"content":{"rendered":"\n<p><img decoding=\"async\" src=\"https:\/\/adfsolutions.com\/wp-content\/uploads\/2026\/01\/Ram-Capture.jpg\" alt=\"Ram Capture\" width=\"300\" height=\"167.36842105263156\" style=\"width: 300px; float: right; margin: 0px 10px 10px 5px;\">Digital forensic experts understand the importance of remembering to perform a <a rel=\" noopener\" href=\"\/news\/ram-dump-forensics\">RAM Capture<\/a> on-scene so as to not leave valuable evidence behind. Capturing volatile data in a computer&#8217;s memory dump enables investigators and examiners to do a full memory analysis and access data including: <!--more--><\/p>\n<ul>\n<li>browsing history<\/li>\n<li>encryption keys<\/li>\n<li>chat messages<\/li>\n<li>clipboard contents&nbsp;<\/li>\n<li>run-time system activity<\/li>\n<li>open network connections (often these artifacts are only found in RAM)<\/li>\n<li>recently executed commands and processes<\/li>\n<li>injected code fragments<\/li>\n<li>memory stored before shut down or crash<\/li>\n<\/ul>\n<p>Here is a short 60 second video to quickly explain the critical importance of RAM Capture in on-scene investigations, serving search warrants, performing <a href=\"\/news\/triage-early-case-assessments\" rel=\" noopener\">Early Case Assessment<\/a>, Incident Response investigations or <a href=\"\/news\/sensitive-site-exploitation\" rel=\" noopener\">Sensitive Site Exploitation<\/a>.&nbsp;<\/p>\n<video width=\"100%\" controls>\n  <source src=\"https:\/\/4330725.fs1.hubspotusercontent-na1.net\/hubfs\/4330725\/What%20is%20RAM%20Capture%20-%20explained%20by%20ADF%20Solutions%20Digital%20Forensics.mp4\" type=\"video\/mp4\">\n<\/video>\n<p>The practice of RAM Capture is an important aspect of memory forensics that can be used&nbsp; during a <a href=\"\/digital-forensics\">digital forensic<\/a> investigation of criminal activity, hacking, cyber crime or insider threats.&nbsp; In the case of hacking, attackers sometimes develop malware that only lives in memory which makes it difficult to detect if random access memory is not captured.<\/p>\n<p>ADF <a href=\"\/dei\">Digital Evidence Investigator<\/a> software allows field investigators to quickly perform a RAM Capture while on-scene.&nbsp; Following the capture of volatile memory, ADF digital forensic software can start the process of scanning the target computer with customized search profiles to allow investigators to immediately begin analysis and to start building HTML or CSV reports which can be shared with other investigators, prosecutors or a forensic lab.&nbsp;<\/p>\n<p><a class=\"optech-default-btn btn-style cta_button\" href=\"https:\/\/cta-redirect.hubspot.com\/cta\/redirect\/4330725\/8096ac52-ac2e-4422-b5a0-076f37761d13\" target=\"_blank\" data-text=\"Learn How: RAM Capture\"><span class=\"btn-wraper\">Learn How: RAM Capture<\/span><\/a><\/p>\n<p style=\"background-color: #f9f9f9; margin: 0px;\">Digital Evidence Investigator<sup><small>\u00ae<\/small><\/sup><span>&nbsp;<\/span>(DEI) software is the #1 automated digital forensic tool for easily collecting RAM as well as digital files and artifacts &#8211; with evidence presented in a timeline view. DEI is automated and easy-to-use for digital evidence collection &amp; analysis with pre-built forensic scans and the ability to build custom scans and reports.&nbsp;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Digital forensic experts understand the importance of remembering to perform a RAM Capture on-scene so as to not leave valuable evidence behind. Capturing volatile data in a computer&#8217;s memory dump enables investigators and examiners to do a full memory analysis and access data including:<\/p>\n","protected":false},"author":4,"featured_media":13468,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"content-type":"","footnotes":""},"categories":[63],"tags":[117,85,74,33,241,100,142,143],"class_list":["post-15005","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news","tag-cyber-crime","tag-cybersecurity","tag-digital-evidence-investigator","tag-digital-forensics","tag-insider-threat","tag-ram-capture","tag-triage-g2","tag-triage-investigator","optech-blog blog-single"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.1.1 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Don&#039;t Forget RAM Capture: A Key to Digital Forensics - ADF Solutions<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/adfsolutions.com\/ram-capture\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Don&#039;t Forget RAM Capture: A Key to Digital Forensics - ADF Solutions\" \/>\n<meta property=\"og:description\" content=\"Digital forensic experts understand the importance of remembering to perform a RAM Capture on-scene so as to not leave valuable evidence behind. Capturing volatile data in a computer&#8217;s memory dump enables investigators and examiners to do a full memory analysis and access data including:\" \/>\n<meta property=\"og:url\" content=\"https:\/\/adfsolutions.com\/ram-capture\/\" \/>\n<meta property=\"og:site_name\" content=\"ADF Solutions\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/adfsolutions\" \/>\n<meta property=\"article:published_time\" content=\"2018-04-20T00:00:00+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-02-18T13:29:41+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/adfsolutions.com\/wp-content\/uploads\/2026\/01\/Ram-Capture-1-1-1024x1024.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1024\" \/>\n\t<meta property=\"og:image:height\" content=\"1024\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"ADF Solutions\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@adfsolutions\" \/>\n<meta name=\"twitter:site\" content=\"@adfsolutions\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"ADF Solutions\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/adfsolutions.com\/ram-capture\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/adfsolutions.com\/ram-capture\/\"},\"author\":{\"name\":\"ADF Solutions\",\"@id\":\"https:\/\/adfsolutions.com\/#\/schema\/person\/4c5574625c6ba44f67522fbd564da0dc\"},\"headline\":\"Don&#8217;t Forget RAM Capture: A Key to Digital Forensics\",\"datePublished\":\"2018-04-20T00:00:00+00:00\",\"dateModified\":\"2026-02-18T13:29:41+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/adfsolutions.com\/ram-capture\/\"},\"wordCount\":313,\"publisher\":{\"@id\":\"https:\/\/adfsolutions.com\/#organization\"},\"image\":{\"@id\":\"https:\/\/adfsolutions.com\/ram-capture\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/adfsolutions.com\/wp-content\/uploads\/2026\/01\/Ram-Capture-1-1.png\",\"keywords\":[\"Cyber Crime\",\"Cybersecurity\",\"Digital Evidence Investigator\",\"Digital Forensics\",\"Insider Threat\",\"RAM Capture\",\"Triage-G2\",\"Triage-Investigator\"],\"articleSection\":[\"News\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/adfsolutions.com\/ram-capture\/\",\"url\":\"https:\/\/adfsolutions.com\/ram-capture\/\",\"name\":\"Don't Forget RAM Capture: A Key to Digital Forensics - ADF Solutions\",\"isPartOf\":{\"@id\":\"https:\/\/adfsolutions.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/adfsolutions.com\/ram-capture\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/adfsolutions.com\/ram-capture\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/adfsolutions.com\/wp-content\/uploads\/2026\/01\/Ram-Capture-1-1.png\",\"datePublished\":\"2018-04-20T00:00:00+00:00\",\"dateModified\":\"2026-02-18T13:29:41+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/adfsolutions.com\/ram-capture\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/adfsolutions.com\/ram-capture\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/adfsolutions.com\/ram-capture\/#primaryimage\",\"url\":\"https:\/\/adfsolutions.com\/wp-content\/uploads\/2026\/01\/Ram-Capture-1-1.png\",\"contentUrl\":\"https:\/\/adfsolutions.com\/wp-content\/uploads\/2026\/01\/Ram-Capture-1-1.png\",\"width\":2560,\"height\":2560},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/adfsolutions.com\/ram-capture\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/adfsolutions.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Don&#8217;t Forget RAM Capture: A Key to Digital Forensics\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/adfsolutions.com\/#website\",\"url\":\"https:\/\/adfsolutions.com\/\",\"name\":\"ADF Solutions\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\/\/adfsolutions.com\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/adfsolutions.com\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/adfsolutions.com\/#organization\",\"name\":\"ADF Solutions\",\"url\":\"https:\/\/adfsolutions.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/adfsolutions.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/adfsolutions.com\/wp-content\/uploads\/2026\/01\/favicon.png\",\"contentUrl\":\"https:\/\/adfsolutions.com\/wp-content\/uploads\/2026\/01\/favicon.png\",\"width\":512,\"height\":512,\"caption\":\"ADF Solutions\"},\"image\":{\"@id\":\"https:\/\/adfsolutions.com\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/adfsolutions\",\"https:\/\/x.com\/adfsolutions\",\"https:\/\/www.linkedin.com\/company\/adf-solutions\/\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/adfsolutions.com\/#\/schema\/person\/4c5574625c6ba44f67522fbd564da0dc\",\"name\":\"ADF Solutions\",\"url\":\"https:\/\/adfsolutions.com\/author\/adfsolutions\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Don't Forget RAM Capture: A Key to Digital Forensics - ADF Solutions","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/adfsolutions.com\/ram-capture\/","og_locale":"en_US","og_type":"article","og_title":"Don't Forget RAM Capture: A Key to Digital Forensics - ADF Solutions","og_description":"Digital forensic experts understand the importance of remembering to perform a RAM Capture on-scene so as to not leave valuable evidence behind. Capturing volatile data in a computer&#8217;s memory dump enables investigators and examiners to do a full memory analysis and access data including:","og_url":"https:\/\/adfsolutions.com\/ram-capture\/","og_site_name":"ADF Solutions","article_publisher":"https:\/\/www.facebook.com\/adfsolutions","article_published_time":"2018-04-20T00:00:00+00:00","article_modified_time":"2026-02-18T13:29:41+00:00","og_image":[{"width":1024,"height":1024,"url":"https:\/\/adfsolutions.com\/wp-content\/uploads\/2026\/01\/Ram-Capture-1-1-1024x1024.png","type":"image\/png"}],"author":"ADF Solutions","twitter_card":"summary_large_image","twitter_creator":"@adfsolutions","twitter_site":"@adfsolutions","twitter_misc":{"Written by":"ADF Solutions","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/adfsolutions.com\/ram-capture\/#article","isPartOf":{"@id":"https:\/\/adfsolutions.com\/ram-capture\/"},"author":{"name":"ADF Solutions","@id":"https:\/\/adfsolutions.com\/#\/schema\/person\/4c5574625c6ba44f67522fbd564da0dc"},"headline":"Don&#8217;t Forget RAM Capture: A Key to Digital Forensics","datePublished":"2018-04-20T00:00:00+00:00","dateModified":"2026-02-18T13:29:41+00:00","mainEntityOfPage":{"@id":"https:\/\/adfsolutions.com\/ram-capture\/"},"wordCount":313,"publisher":{"@id":"https:\/\/adfsolutions.com\/#organization"},"image":{"@id":"https:\/\/adfsolutions.com\/ram-capture\/#primaryimage"},"thumbnailUrl":"https:\/\/adfsolutions.com\/wp-content\/uploads\/2026\/01\/Ram-Capture-1-1.png","keywords":["Cyber Crime","Cybersecurity","Digital Evidence Investigator","Digital Forensics","Insider Threat","RAM Capture","Triage-G2","Triage-Investigator"],"articleSection":["News"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/adfsolutions.com\/ram-capture\/","url":"https:\/\/adfsolutions.com\/ram-capture\/","name":"Don't Forget RAM Capture: A Key to Digital Forensics - ADF Solutions","isPartOf":{"@id":"https:\/\/adfsolutions.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/adfsolutions.com\/ram-capture\/#primaryimage"},"image":{"@id":"https:\/\/adfsolutions.com\/ram-capture\/#primaryimage"},"thumbnailUrl":"https:\/\/adfsolutions.com\/wp-content\/uploads\/2026\/01\/Ram-Capture-1-1.png","datePublished":"2018-04-20T00:00:00+00:00","dateModified":"2026-02-18T13:29:41+00:00","breadcrumb":{"@id":"https:\/\/adfsolutions.com\/ram-capture\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/adfsolutions.com\/ram-capture\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/adfsolutions.com\/ram-capture\/#primaryimage","url":"https:\/\/adfsolutions.com\/wp-content\/uploads\/2026\/01\/Ram-Capture-1-1.png","contentUrl":"https:\/\/adfsolutions.com\/wp-content\/uploads\/2026\/01\/Ram-Capture-1-1.png","width":2560,"height":2560},{"@type":"BreadcrumbList","@id":"https:\/\/adfsolutions.com\/ram-capture\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/adfsolutions.com\/"},{"@type":"ListItem","position":2,"name":"Don&#8217;t Forget RAM Capture: A Key to Digital Forensics"}]},{"@type":"WebSite","@id":"https:\/\/adfsolutions.com\/#website","url":"https:\/\/adfsolutions.com\/","name":"ADF Solutions","description":"","publisher":{"@id":"https:\/\/adfsolutions.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/adfsolutions.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/adfsolutions.com\/#organization","name":"ADF Solutions","url":"https:\/\/adfsolutions.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/adfsolutions.com\/#\/schema\/logo\/image\/","url":"https:\/\/adfsolutions.com\/wp-content\/uploads\/2026\/01\/favicon.png","contentUrl":"https:\/\/adfsolutions.com\/wp-content\/uploads\/2026\/01\/favicon.png","width":512,"height":512,"caption":"ADF Solutions"},"image":{"@id":"https:\/\/adfsolutions.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/adfsolutions","https:\/\/x.com\/adfsolutions","https:\/\/www.linkedin.com\/company\/adf-solutions\/"]},{"@type":"Person","@id":"https:\/\/adfsolutions.com\/#\/schema\/person\/4c5574625c6ba44f67522fbd564da0dc","name":"ADF Solutions","url":"https:\/\/adfsolutions.com\/author\/adfsolutions\/"}]}},"_links":{"self":[{"href":"https:\/\/adfsolutions.com\/wp-json\/wp\/v2\/posts\/15005","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/adfsolutions.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/adfsolutions.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/adfsolutions.com\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/adfsolutions.com\/wp-json\/wp\/v2\/comments?post=15005"}],"version-history":[{"count":2,"href":"https:\/\/adfsolutions.com\/wp-json\/wp\/v2\/posts\/15005\/revisions"}],"predecessor-version":[{"id":16476,"href":"https:\/\/adfsolutions.com\/wp-json\/wp\/v2\/posts\/15005\/revisions\/16476"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/adfsolutions.com\/wp-json\/wp\/v2\/media\/13468"}],"wp:attachment":[{"href":"https:\/\/adfsolutions.com\/wp-json\/wp\/v2\/media?parent=15005"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/adfsolutions.com\/wp-json\/wp\/v2\/categories?post=15005"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/adfsolutions.com\/wp-json\/wp\/v2\/tags?post=15005"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}