Sign up ×
Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

I work as a Information Security analyst and was recently tasked to look into Incident response + computer forensics related topics. For starters, I am experimenting on my PC which is running Windows 7 64 bit SP1). I have downloaded a live memory analysis tool named Volatility and tried the first command:

python pslist -f /path/to/memory.img --profile=Win7SP1x64=

I got an error stating that I don't have image or file for analysis and realised I have no clue how to dump live O/S memory into a file.

I did some Google search for tools e.g encase, helix, MDD, hBGARY but found these tools to be far complex for my current knowledge about this field. Furthermore these tools aren't free.

share|improve this question
Isn't the memory stored in hiberfil.sys when you hibernate? You could read that file with a Linux live boot. – Luc Jun 19 '13 at 19:33
I recommend Rekall ( over Volatility. – NNzz Aug 22 at 16:51
Isn't it a little strange that a infosec company doesn't have a standardised method for doing this? – munchkin Aug 23 at 15:12

4 Answers 4

up vote 6 down vote accepted

If you google for forensic memory dump tools, one of the first ones to come up is the free Microsoft SysInternals tool, LiveKd. Helix is also free, and has greater functionality. Download the Helix ISO and have a good look at the tools available.

As far as complexity, all these tools provide a wide range of functionality. This shouldn't be confused with being too complex, as you will just use the functions you need. This goes for Volatility as well.

share|improve this answer
Thank you for your post. I will try with Helix ISO and see how well it goes. – Saladin Aug 18 '12 at 19:16
LiveKd rocks. Not sure what I'd do without it. – Polynomial Aug 19 '12 at 20:03

I believe that ProcDump also works and is maintained by Microsoft. It allows a dump to occur when certain conditions are met like a high CPU usage.

share|improve this answer

Try DumpIt. The dumps can be used with volatility.

share|improve this answer

RamCapture worked for me pretty well - it just needs admin rights.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.