Winpmem Documentation

https://winpmem.velocidex.com/docs/

Admin

Winpmem is a simple memory imager that creates raw images of physical memory for forensic analysis.

Tokens:162

Snippets:4

Trust Score:7.7

Update:3 months ago

Show doc for...

Tokens:

Raw

### Run WinPmem Imager

Source: https://winpmem.velocidex.com/docs

Execute the WinPmem imager to write a RAW memory image to a file. This is the basic command for creating a memory dump.

```bash
winpmem_mini_x64.exe physmem.raw
```

Tokens:

Raw