Windows winpmem : winpmem_mini_x64_rc2.exe memory.dmp DumpIt FTK Imager (for usage, see : Formation_DFIR.pdf (slide 599)) Linux linpmem : ./linpmem -o /path/to/output/file.aff4 LiME
