Ftk Imager 3.4.0.1 -

Unlike some lightweight imaging tools, FTK Imager includes capabilities for:

A significant feature of the 3.x series is the ability to capture volatile memory (RAM) and the page file. In modern forensics, "live" data—data currently in the computer’s memory—is just as important as what is stored on the hard drive. Encryption keys, running malware processes, and unsaved documents often reside only in RAM. FTK Imager 3.4.0.1 allows investigators to dump this memory into a file for analysis. ftk imager 3.4.0.1