DFS101: 10.2 Forensic Memory Acquisition in Windows - FTK Imager

[@kaymaxtrol]

Please I have a question , I have the ftk imager, I want to use one of my USB stick or phone as a suspect material..how exactly do I collect the data to enable ftk read it and carry out forensic, do I have to convert to iso or just raw file? Many thanks in response

[@sulthansk6444]

How to do memory forensic with this dump file ??(volatility)

[@240dbprisms5]

I think you'd need a raw physical memory dump output for that, try magnet ram capture

[@sulthansk6444]

@@240dbprisms5 thanks mate...

[@triumphant_54]

i can barely see anything.... i dont know if i'm the only one having this problem..