Introduction to Live Forensics | What data you can recover from RAM Memory | Volatility 3

Do we really need to capture the memory dump?
The Random Access Memory (RAM) data are the most volatile and can be easily lost. As a result, they are losing very useful evidence, including system information, user and program information, passwords, network state information, register keys and other types of valuable data.
Volatility 3

[@DreamLifeAfrica]

Interesting Live forensics

[@user-up5ne9jk1o]

Explained neatly. Very simple. Thank you very much

[@hassanansari9836]

❤❤

[@nabeilelhawat9568]

A good one

[@CyDig]

Thanks

[@hassanansari9836]

Thank You my bro
So we Could Restore or Recover all this Data from a turned off ram, yes?
or it's about an at time running RAM?

[@CyDig]

You can only recover all data while the computer is on. Once you shutdown the computer the data will be lost. That’s why the called volatile data and live forensics.

[@nawrasmrabet6065]

👍👍👍