Once a folder is chosen, RAM capture will start and the progress will be shown in the Memory tab. The utility will then prompt a screen to select the folder in which the dump will be saved. It should be noted, the medium that will hold the data must be of sufficient size. Once you are made Admin, press the “Capture RAM” button to start capturing data. RAM dump can only be created with elevated privileges, such as Admin rights, so before proceeding, the investigator must press the Elevate button on the KeyScout Home screen. Start Oxygen Forensic® KeyScout on a subject’s computer. Locate Oxygen Forensic® KeyScout on the Home screen of Oxygen forensic® Detective and copy it to a USB drive.
This means investigators will now have access to the full scope of data with Oxygen Forensic® KeyScout.
It’s important to note that maintaining a small footprint without installation helps obtain the most amount of RAM for analysis of the Windows 10 environment. It has the smallest possible footprint and requires no installation. To capture RAM with Oxygen Forensic® Detective, investigators will need to use the built-in Oxygen Forensic® KeyScout utility.