The SANS institute recommends to perform a RAM image before trying to collect data from live systems (SANS Link).
I'm also following an online training where the trainer collects live data (processes list, network connections, ...) without performing first a RAM image.
In the latter case, are the evidences collected admissible in a court (if the case has to go that far)?

2 Answers 2


All the evidences collected could be accepted in a court.

But, the difference is the probative value of your analysis.

If you are mandated by a judge, your work and your expertise will have a very strong influence on future debates. Similarly, if you are accompanied by a bailiff who can attest to your actions during the analysis of the system, the legal aspect will be covered by his function and your analysis will have too a big influence.

Doing a RAM image when possible is a good practice, moreover, take a lot of informations from a live system is good manner to retrieve artifacts. If you can do a timeline between the two analyses you will have a good and clear idea of the system state during his last "power-on".

It's recommended to do a RAM image in first because you could alter the RAM during yours operations on the live system. And if you do the RAM image after,you will have some artifacts of yours operations and not of the system before your intervention.

  • Excellent, thank you very much, that's what i thought
    – Othman
    Oct 5, 2015 at 19:45

It is worth mentioning that if you do not dump contents of RAM once computer is shutdown if there is any disk encryption you will be unable to access the HDD. At least with a RAM image you can find the password string.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .