RB-EVIDENCE-001: Memory Acquisition
Document Control
| Attribute | Value | Date |
|---|---|---|
| Document Name | Memory Acquisition | |
| Version | [Enter version number] | [Enter date] |
| Owner | [Enter owner/team] | [Enter date] |
| Status | [Draft/Approved/Retired] | [Enter date] |
| Next Review Date | [Enter next review date] | [Enter date] |
| Approvals | [Enter approver(s)] | [Enter date] |
| Change Summary | Initial creation | [Enter date] |
1. Prerequisites
- Impacted host identifier (hostname, asset ID, IP, instance ID)
- Authorisation to capture memory from the host
- Access to the host (local, remote, EDR live-response, or cloud console)
- Sufficient storage destination for the resulting image (size of physical RAM)
Required Tools:
- Memory acquisition tool appropriate for the OS (e.g. WinPMEM, DumpIt, Magnet RAM Capture, AVML, EDR live-response)
- Hashing utility (SHA-256)
- Secure transfer path to evidence storage
2. Step-by-Step Instructions
Common Failure Modes
- Rebooting or shutting down the host before acquisition
- Running unnecessary tools that modify memory state
- Failing to capture acquisition metadata or hashes
- Losing chain of custody during transfer
-
Validate Need for Memory Acquisition
- Confirm at least one of:
- Active threat activity suspected on the host
- In-memory execution suspected
- Credential theft or process injection suspected
- Host required for forensic preservation regardless of current state
- Confirm acquisition will not destroy more evidence than it preserves (e.g. if the tool requires reboot/install, weigh trade-offs)
- Confirm at least one of:
-
Acquire Memory Safely
- Avoid rebooting, shutting down, or running unnecessary tools on the host prior to acquisition
- Perform a full physical memory acquisition using an approved tool
- Verify the resulting image is complete and not zero-bytes before releasing the host
3. Post-Action
- Transfer the image to the designated evidence storage location via a secure path
- Verify the SHA-256 hash matches before and after transfer
- Record acquisition metadata: operator, timestamp, host, tool, tool version, and the SHA-256 hash of the resulting image
- Confirm chain of custody is recorded end-to-end (capture → transfer → storage)
Contributor
Vishal Thakur
GitHub: https://github.com/malienist
Jayden Vo GitHub: https://github.com/jayden-vo
Contributed to the Arcana Incident Response Documentation Framework.