DD

         To gain a full memory dump, we can use dd (standing for "data description"). DD is often hard to use. It took quite a bit of playing with to get it work for us during an analysis we had done recently. Download the dd program here: http://www.gmgsystemsinc.com/fau/. The command to use is "dd.exe if=\\.\physicalmemory of=[full path of where to write file].dd bs=4096". The if statement tells dd to dump the physical memory. of is the path of where that dump should go. For example z:\[filename].dd. And bs=4096 lets us copy large amounts of data faster and more stable.

Persomal Remarks: DD is by far a great tool to use to get a full image of a disk. I am personally not impressed with it's memory acquistion. It's a farily finicky program and can take a couple of runs to get it to go write. The positive of it is that it doesn't leave a large fingerprint when it's on a machine and capturing the memory, as opposed to FTK Imager.