Talk:RAM Analysis

Write the first paragraph of your page here.

Sample command
The given example command is currently this:

dd.exe if=\\.\ PhysicalDrive0 of=d:\images\PhysicalDrive0.img conv=noerror

I might be mistaken, but this seems to be for dumping the primary storage device, which is usually a hard drive. Since this page is about RAM analysis, can't we specify the command for physical memory? It would then be:

dd.exe if=\\.\ PhysicalMemory of=d:\images\PhysicalMemory.img conv=noerror

137.215.6.53 12:57, October 26, 2013 (UTC)PRB