# Collect-MemoryDump | Automated Creation Of Windows Memory Snapshots For DFIR **URL:** \ **Category:** Tools & Scripts\ **Tags:** tools, programming, freebies\ **Created:** [November 7, 2022, 9:50pm UTC](https://onehack.st/t/collect-memorydump-automated-creation-of-windows-memory-snapshots-for-dfir/228057 "2022-11-07T21:50:23Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![WhiteHat](https://onehack.st/user_avatar/onehack.st/whitehat/32/162514_2.png) [@WhiteHat](https://onehack.st/u/WhiteHat)\ **Post date:** [November 7, 2022, 9:50pm UTC](https://onehack.st/t/collect-memorydump-automated-creation-of-windows-memory-snapshots-for-dfir/228057/1 "2022-11-07T21:50:24Z")
![image](https://onehack.st/uploads/default/original/3X/0/1/011d2d604111b90d0172b6a0e8ce7878a1ff018c.jpeg) Collect-MemoryDump - Automated Creation of Windows Memory Snapshots for DFIR Collect-MemoryDump.ps1 is PowerShell script utilized to collect a Memory Snapshot from a live Windows system (in a forensically sound manner). Features: - Checks for Hostname and Physical Memory Size before starting memory acquisition - Checks if you have enough free disk space to save memory dump file - Collects a Raw Physical Memory Dump w/ DumpIt, Magnet Ram Capture, Belkasoft Live RAM Capturer and WinPMEM - Collects a Microsoft Crash Dump w/ DumpIt for Comae Beta from Magnet Idea Lab - Pagefile Collection w/ CyLR - Live Response Collection tool by Alan Orlikoski and Jason Yegge - Checks for Encrypted Volumes w/ Magnet Forensics Encrypted Disk Detector - Collects BitLocker Recovery Key - Checks for installed Endpoint Security Tools (AntiVirus and EDR) - Enumerates all necessary information from the target host to enrich your DFIR workflow - Creates a password-protected Secure Archive Container (PW: IncidentResponse) ## First Public Release MAGNET Talks - Frankfurt, Germany (July 27, 2022) Presentation Title: Modern Digital Forensics and Incident Response Techniques > **[Magnet Forensics | Gain an Investigative Edge](https://www.magnetforensics.com/)** > > Gain an Investigative Edge. We provide organizations with innovative tools to investigate cyberattacks and digital crimes. ## Download Download the latest version of **Collect-MemoryDump** from the [Releases](https://github.com/evild3ad/Collect-MemoryDump/releases/latest) section. > Note: Collect-MemoryDump does not include all external tools by default. You have to download following dependencies: - [Belkasoft Live RAM Capturer](https://belkasoft.com/ram-capturer) - [Comae-Toolkit](https://www.magnetforensics.com/blog/how-to-get-started-with-comae/) - [MAGNET Encrypted Disk Detector](https://www.magnetforensics.com/resources/encrypted-disk-detector/) - [MAGNET Ram Capture](https://www.magnetforensics.com/resources/magnet-ram-capture/) Copy the required files to following file locations: **Belkasoft Live RAM Capturer** `$SCRIPT_DIR\Tools\RamCapturer\x64\msvcp110.dll` `$SCRIPT_DIR\Tools\RamCapturer\x64\msvcr110.dll` `$SCRIPT_DIR\Tools\RamCapturer\x64\RamCapture64.exe` `$SCRIPT_DIR\Tools\RamCapturer\x64\RamCaptureDriver64.sys` `$SCRIPT_DIR\Tools\RamCapturer\x86\msvcp110.dll` `$SCRIPT_DIR\Tools\RamCapturer\x86\msvcr110.dll` `$SCRIPT_DIR\Tools\RamCapturer\x86\RamCapture.exe` `$SCRIPT_DIR\Tools\RamCapturer\x86\RamCaptureDriver.sys` **Comae-Toolkit** `$SCRIPT_DIR\Tools\DumpIt\ARM64\DumpIt.exe` `$SCRIPT_DIR\Tools\DumpIt\x64\DumpIt.exe` `$SCRIPT_DIR\Tools\DumpIt\x86\DumpIt.exe` **MAGNET Encrypted Disk Detector** `$SCRIPT_DIR\Tools\EDD\EDDv310.exe` **MAGNET Ram Capture** `$SCRIPT_DIR\Tools\MRC\MRCv120.exe` ## Usage .\Collect-MemoryDump.ps1 [-Tool] [–Pagefile] Example 1 - Raw Physical Memory Snapshot .\Collect-MemoryDump.ps1 -DumpIt Example 2 - Microsoft Crash Dump (.zdmp) → optimized for uploading to [Comae Investigation Platform](https://www.comae.com/) .\Collect-MemoryDump.ps1 -Comae Note: You can uncompress \*.zdmp files generated by DumpIt w/ Z2Dmp (Comae-Toolkit). Example 3 - Raw Physical Memory Snapshot and Pagefile Collection → [MemProcFS](https://github.com/ufrisk/MemProcFS) .\Collect-MemoryDump.ps1 -WinPMEM --Pagefile [![Help-Message](https://github.com/evild3ad/Collect-MemoryDump/raw/3aa95e224d0613681d5cd1baaf3e8a22da40bf68/Screenshots/01.png)](https://github.com/evild3ad/Collect-MemoryDump/blob/3aa95e224d0613681d5cd1baaf3e8a22da40bf68/Screenshots/01.png) **Fig 1:** Help Message [![AvailableSpace](https://github.com/evild3ad/Collect-MemoryDump/raw/3aa95e224d0613681d5cd1baaf3e8a22da40bf68/Screenshots/02.png)](https://github.com/evild3ad/Collect-MemoryDump/blob/3aa95e224d0613681d5cd1baaf3e8a22da40bf68/Screenshots/02.png) **Fig 2:** Check Available Space [![DumpIt](https://github.com/evild3ad/Collect-MemoryDump/raw/3aa95e224d0613681d5cd1baaf3e8a22da40bf68/Screenshots/03.png)](https://github.com/evild3ad/Collect-MemoryDump/blob/3aa95e224d0613681d5cd1baaf3e8a22da40bf68/Screenshots/03.png) **Fig 3:** Automated Creation of Windows Memory Snapshot w/ DumpIt [![RamCapture](https://github.com/evild3ad/Collect-MemoryDump/raw/3aa95e224d0613681d5cd1baaf3e8a22da40bf68/Screenshots/04.png)](https://github.com/evild3ad/Collect-MemoryDump/blob/3aa95e224d0613681d5cd1baaf3e8a22da40bf68/Screenshots/04.png) **Fig 4:** Automated Creation of Windows Memory Snapshot w/ Magnet RAM Capture [![WinPMEM](https://github.com/evild3ad/Collect-MemoryDump/raw/3aa95e224d0613681d5cd1baaf3e8a22da40bf68/Screenshots/05.png)](https://github.com/evild3ad/Collect-MemoryDump/blob/3aa95e224d0613681d5cd1baaf3e8a22da40bf68/Screenshots/05.png) **Fig 5:** Automated Creation of Windows Memory Snapshot w/ WinPMEM [![Belkasoft](https://github.com/evild3ad/Collect-MemoryDump/raw/3aa95e224d0613681d5cd1baaf3e8a22da40bf68/Screenshots/06.png)](https://github.com/evild3ad/Collect-MemoryDump/blob/3aa95e224d0613681d5cd1baaf3e8a22da40bf68/Screenshots/06.png) **Fig 6:** Automated Creation of Windows Memory Snapshot w/ Belkasoft Live RAM Capturer [![Comae](https://github.com/evild3ad/Collect-MemoryDump/raw/3aa95e224d0613681d5cd1baaf3e8a22da40bf68/Screenshots/07.png)](https://github.com/evild3ad/Collect-MemoryDump/blob/3aa95e224d0613681d5cd1baaf3e8a22da40bf68/Screenshots/07.png) **Fig 7:** Automated Creation of Windows Memory Snapshot w/ DumpIt (Microsoft Crash Dump) [![WinPMEM](https://github.com/evild3ad/Collect-MemoryDump/raw/3aa95e224d0613681d5cd1baaf3e8a22da40bf68/Screenshots/08.png)](https://github.com/evild3ad/Collect-MemoryDump/blob/3aa95e224d0613681d5cd1baaf3e8a22da40bf68/Screenshots/08.png) **Fig 8:** Automated Creation of Windows Memory Snapshot w/ WinPMEM and Pagefile Collection w/ CyLR [![MessageBox](https://github.com/evild3ad/Collect-MemoryDump/raw/3aa95e224d0613681d5cd1baaf3e8a22da40bf68/Screenshots/09.png)](https://github.com/evild3ad/Collect-MemoryDump/blob/3aa95e224d0613681d5cd1baaf3e8a22da40bf68/Screenshots/09.png) **Fig 9:** Message Box [![SecureArchive](https://github.com/evild3ad/Collect-MemoryDump/raw/3aa95e224d0613681d5cd1baaf3e8a22da40bf68/Screenshots/10.png)](https://github.com/evild3ad/Collect-MemoryDump/blob/3aa95e224d0613681d5cd1baaf3e8a22da40bf68/Screenshots/10.png) **Fig 10:** Secure Archive Container (PW: IncidentResponse) and Logfile.txt [![OutputDirectories](https://github.com/evild3ad/Collect-MemoryDump/raw/3aa95e224d0613681d5cd1baaf3e8a22da40bf68/Screenshots/11.png)](https://github.com/evild3ad/Collect-MemoryDump/blob/3aa95e224d0613681d5cd1baaf3e8a22da40bf68/Screenshots/11.png) **Fig 11:** Output Directories [![MemoryDirectories](https://github.com/evild3ad/Collect-MemoryDump/raw/3aa95e224d0613681d5cd1baaf3e8a22da40bf68/Screenshots/12.png)](https://github.com/evild3ad/Collect-MemoryDump/blob/3aa95e224d0613681d5cd1baaf3e8a22da40bf68/Screenshots/12.png) **Fig 12:** Memory Directories (WinPMEM and Pagefile) [![Memory](https://github.com/evild3ad/Collect-MemoryDump/raw/3aa95e224d0613681d5cd1baaf3e8a22da40bf68/Screenshots/13.png)](https://github.com/evild3ad/Collect-MemoryDump/blob/3aa95e224d0613681d5cd1baaf3e8a22da40bf68/Screenshots/13.png) **Fig 13:** Memory Snapshot (in a forensically sound manner) [![Pagefile](https://github.com/evild3ad/Collect-MemoryDump/raw/3aa95e224d0613681d5cd1baaf3e8a22da40bf68/Screenshots/14.png)](https://github.com/evild3ad/Collect-MemoryDump/blob/3aa95e224d0613681d5cd1baaf3e8a22da40bf68/Screenshots/14.png) **Fig 14:** Pagefile Collection [![SystemInfo](https://github.com/evild3ad/Collect-MemoryDump/raw/3aa95e224d0613681d5cd1baaf3e8a22da40bf68/Screenshots/15.png)](https://github.com/evild3ad/Collect-MemoryDump/blob/3aa95e224d0613681d5cd1baaf3e8a22da40bf68/Screenshots/15.png) **Fig 15:** Collected System Information ## Dependencies 7-Zip 22.01 Standalone Console (2022-07-15) > **[Download](https://www.7-zip.org/download.html)** Belkasoft Live RAM Capturer (2018-10-22) > **[A Forensic Tool for Memory Acquisition](https://belkasoft.com/ram-capturer)** > > Obtain ephemeral evidence with memory forensics tools! Learn how Belkasoft RAM Capturer, a free forensics tool, helps extract data like passwords and login credentials from computers’ volatile memory. DumpIt 3.5.0 (2022-08-02) → Comae-Toolkit > **[MAGNET Idea Lab -](https://magnetidealab.com/)** > > As a member of the Magnet Idea Lab you will: Gain exclusive access to early-stage product concepts and participate in beta testing Have opportunities to meet with members of our product development team one-on-one to share feedback Complete various... [https://beta.comae.tech/](https://beta.comae.tech/) CyLR 3.0 (2021-02-03) > **[GitHub - orlikoski/CyLR: CyLR - Live Response Collection Tool](https://github.com/orlikoski/CyLR)** > > CyLR - Live Response Collection Tool Magnet Encrypted Disk Detector v3.1.0 (2022-06-19) > **[Magnet Encrypted Disk Detector - Magnet Forensics](https://www.magnetforensics.com/resources/encrypted-disk-detector/)** > > Empower frontline officers to collect and report on fleeting digital evidence from consenting victims and witnesses. [https://support.magnetforensics.com/s/free-tools](https://support.magnetforensics.com/s/free-tools) Magnet RAM Capture v1.2.0 (2019-07-24) > **[Magnet RAM Capture - Magnet Forensics](https://www.magnetforensics.com/resources/magnet-ram-capture/)** > > Magnet RAM Capture: What does it do? Magnet RAM Capture is a free imaging tool designed to capture the physical memory of… [https://support.magnetforensics.com/s/software-and-downloads?productTag=free-tools](https://support.magnetforensics.com/s/software-and-downloads?productTag=free-tools) PsLoggedOn v1.35 (2016-06-29) > **[PsLoggedOn - Sysinternals](https://learn.microsoft.com/de-de/sysinternals/downloads/psloggedon)** > > Das Programm zeigt Benutzer an, die bei einem System angemeldet sind. WinPMEM 4.0 RC2 (2020-10-12) > **[Releases · Velocidex/WinPmem](https://github.com/Velocidex/WinPmem/releases)** > > The multi-platform memory acquisition tool. Contribute to Velocidex/WinPmem development by creating an account on GitHub. ## Links [Belkasoft Live RAM Capturer](https://belkasoft.com/ram-capturer) [Comae-Toolkit incl. DumpIt](https://www.magnetforensics.com/blog/how-to-get-started-with-comae/) [CyLR - Live Response Collection Tool](https://github.com/orlikoski/CyLR) [MAGNET Encrypted Disk Detector](https://www.magnetforensics.com/resources/encrypted-disk-detector/) [MAGNET Ram Capture](https://www.magnetforensics.com/resources/magnet-ram-capture/) [WinPMEM](https://github.com/Velocidex/WinPmem) [![Comae](https://camo.githubusercontent.com/ef8021ec2aa01aac76890a7cf3552e1e93d74c9ed637f21ef2e3c17e1d5ac401/68747470733a2f2f7777772e636f6d61652e636f6d2f696d616765732f4d465f436f6d61655f4163717569736974696f6e5f436f6d616557656273697465325f31323030783637352e6a7067)](https://camo.githubusercontent.com/ef8021ec2aa01aac76890a7cf3552e1e93d74c9ed637f21ef2e3c17e1d5ac401/68747470733a2f2f7777772e636f6d61652e636f6d2f696d616765732f4d465f436f6d61655f4163717569736974696f6e5f436f6d616557656273697465325f31323030783637352e6a7067) [MAGNET Idea Lab - Apply To Join](https://magnetidealab.com/) ## GitHub: > **[GitHub - LETHAL-FORENSICS/Collect-MemoryDump: Collect-MemoryDump - Automated Creation of Windows...](https://github.com/LETHAL-FORENSICS/Collect-MemoryDump)** > > Collect-MemoryDump - Automated Creation of Windows Memory Snapshots for DFIR