Best way to capture volatile memory
by walterbyrd from LinuxQuestions.org on (#5AXC7)
Of these four ways, what is the best way to capture volatile memory comprehensively from a running machine for forensic purposes?
1. FTK Imager
2. memdump -k
3. dd if=/dev/mem . . .
4. LiME, or other kernel module capture utility?
1. FTK Imager
2. memdump -k
3. dd if=/dev/mem . . .
4. LiME, or other kernel module capture utility?