Collect-MemoryDump - Automated Creation Of Windows Memory Snapshots For DFIR

Collect-MemoryDump - Automated Creation of Windows Memory Snapshots for DFIR

Collect-MemoryDump.ps1 is PowerShell script utilized to collect a Memory Snapshot from a live Windows system (in a forensically sound manner).

Features:

• Checks for Hostname and Physical Memory Size before starting memory acquisition
• Checks if you have enough free disk space to save memory dump file
• Collects a Raw Physical Memory Dump w/ DumpIt, Magnet Ram Capture, Belkasoft Live RAM Capturer and WinPMEM
• Collects a Microsoft Crash Dump w/ DumpIt for …

automated dfir memory memory acquisition memory forensics snapshots windows winpmem