How to collect RAM on a live Windows scan
The first order of business should be the volatile data or collecting the RAM. ADF has simplified the process and will expeditiously and efficiently collect the volatile data first. Once the RAM collection is saved to the collection key and completed you can next go right to the scanning of the drives, partitions, or attached devices for relevant and actionable evidence. This will allow you to make critical on-scene decisions