| Template | memory-acquisition |
| Case | Live RAM capture (CASE-MEM) |
| FIR | FIR-2026-77 |
| Analyst | Pallavi Pawar |
| Organisation | Innovativa SoftTech |
| memory.tool: Magnet RAM Capture 1.2 |
| memory.size: 16 GB |
| memory.systemState: Powered on, user logged in |
| memory.acquiredAt: 2026-06-18 03:20 IST |
| SOURCE_DEVICE |
| DeviceName=Suspect workstation |
| DeviceType=Desktop PC |
| DeviceMake=Dell |
| DeviceModel=OptiPlex 7090 |
| SUMMARY files=1 size=53477376 matches=1 mismatches=0 errors=0 |
| ANNEXURE |
| 1. evidence-1.dd | 53477376 | Verified |
| SHA-256=874e9c3ea2b3c4dda2b3c4e5a2b3c4eda2b3c4f5a2b3c4fda2b3c505a2b3c50d |
| VERIFICATION verified=1 failed=0 errors=0 |
| DECLARATION I certify that the volatile memory (RAM) of the system identified above was acquired using the tool and method recorded, that the cryptographic hash values of the resulting memory image were computed with e-Dex and are reproduced in the annexure, and that the verification result stated above reflects, accurately and completely, the integrity of the acquired image as against the recorded values. |