d35f76106b5efa3fc9a0ef250af5cb4bb22525866700a6b4008651904ba2a2d1 Recompute SHA-256 over each sealedContent line followed by a newline (UTF-8); the result must equal the stated hash. fixture MEMORY ACQUISITION CERTIFICATE Template: memory-acquisition Case: Live RAM capture (CASE-MEM) FIR: FIR-2026-77 Analyst: Pallavi Pawar Organisation: Innovativa SoftTech memory.tool: Magnet RAM Capture 1.2 memory.size: 16 GB memory.systemState: Powered on, user logged in memory.acquiredAt: 2026-06-18 03:20 IST SOURCE_DEVICE DeviceName=Suspect workstation DeviceType=Desktop PC DeviceMake=Dell DeviceModel=OptiPlex 7090 SUMMARY files=1 size=53477376 matches=1 mismatches=0 errors=0 ANNEXURE 1. evidence-1.dd | 53477376 | Verified SHA-256=874e9c3ea2b3c4dda2b3c4e5a2b3c4eda2b3c4f5a2b3c4fda2b3c505a2b3c50d VERIFICATION verified=1 failed=0 errors=0 DECLARATION I certify that the volatile memory (RAM) of the system identified above was acquired using the tool and method recorded, that the cryptographic hash values of the resulting memory image were computed with e-Dex and are reproduced in the annexure, and that the verification result stated above reflects, accurately and completely, the integrity of the acquired image as against the recorded values.