The SANS institute recommends to perform a RAM image before trying to collect data from live systems (SANS Link).
I'm also following an online training where the trainer collects live data (processes list, network connections, ...) without performing first a RAM image.
In the latter case, are the evidences collected admissible in a court (if the case has to go that far)?


All the evidences collected could be accepted in a court.

But, the difference is the probative value of your analysis.

If you are mandated by a judge, your work and your expertise will have a very strong influence on future debates. Similarly, if you are accompanied by a bailiff who can attest to your actions during the analysis of the system, the legal aspect will be covered by his function and your analysis will have too a big influence.

Doing a RAM image when possible is a good practice, moreover, take a lot of informations from a live system is good manner to retrieve artifacts. If you can do a timeline between the two analyses you will have a good and clear idea of the system state during his last "power-on".

It's recommended to do a RAM image in first because you could alter the RAM during yours operations on the live system. And if you do the RAM image after,you will have some artifacts of yours operations and not of the system before your intervention.

  • Excellent, thank you very much, that's what i thought
    – Othman
    Oct 5 '15 at 19:45

It is worth mentioning that if you do not dump contents of RAM once computer is shutdown if there is any disk encryption you will be unable to access the HDD. At least with a RAM image you can find the password string.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.