I work as a Information Security analyst and was recently tasked to look into Incident response + computer forensics related topics. For starters, I am experimenting on my PC which is running Windows 7 64 bit SP1). I have downloaded a live memory analysis tool named Volatility and tried the first command:
python vol.py pslist -f /path/to/memory.img --profile=Win7SP1x64=
I got an error stating that I don't have image or file for analysis and realised I have no clue how to dump live O/S memory into a file.
I did some Google search for tools e.g encase, helix, MDD, hBGARY but found these tools to be far complex for my current knowledge about this field. Furthermore these tools aren't free.
Note that I am NOT looking for recommendations for which tool to use, I would like to understand the process and how to go about taking memory dumps for forensics.