FEX Memory Imager (FEX Memory) is a free imaging tool designed to capture the physical Random Access Memory (RAM) of a suspect’s running computer. This allows investigators to recover and analyze valuable artifacts found only in memory.
FEX Memory has a very small operating footprint that minimizes RAM overwrite. RAM is captured to a .raw file that can be opened and analyzed with Forensic Explorer or other forensic tools.
FEX Memory is based upon the well known open source WinPmem memory acquisition driver.