Traditional digital forensics, or what is often referred to now as dead box forensics, focuses on the hard disk drive that's been taken from a shut-down system acting as the primary source of evidence. This approach works well when addressing criminal activity such as fraud or child exploitation where image files, word processor documents, and spreadsheets can be discovered in a forensically sound manner. The issue with this approach is that, to properly acquire this evidence, the system has to be powered off, thereby destroying any potential evidence that could be found within the volatile memory.

As opposed to traditional criminal activity, incident responders will find that a great deal of evidence for a security incident is contained within the memory of a potentially compromised system. This is especially true when examining systems that have been infected with malware or exploited by utilizing a common platform such as Metasploit. Trace evidence is often found within the running memory of the compromised system. As a result, before powering down the system and removing the hard drive, it is critical that the running memory is acquired for processing.

There are several free and commercial tools that can be leveraged by incident response analysts to acquire the running memory. Which tool is used will often be dependent on the techniques and tools that will be used during the analysis phase. Two popular frameworks for a detailed analysis of memory images are Rekall and Volatility.

Running memory can be acquired in two ways. First, memory can be acquired locally via a USB device or other writable medium that is directly connected to the suspect system. The other method of acquiring memory is through a remote connection. This can be facilitated through the use of specialized software that performs the acquisition over a network connection.