Computer Memory Stats

Computer memory is known as RAM (Random Access Memory). It's a form of short-term data storage for PCs, as opposed to hard drives and flash memory drives that allow for long-term storage of data. You can't save any data to your computer's memory--when you reboot your system, all the information currently flowing through the memory is lost.

For example, if you have a term paper you've been writing, you can load an old version from the hard drive into your computer's memory by opening it with a word processing program. Then you can manipulate it and make changes. But you'll want to save it often, because you're just holding it in the RAM, and if your computer crashes you'll lose the current unsaved version.

Bad computer memory is one of the main reasons for random Windows system failures. Testing your PC for memory issues is key for Windows administrators who want to avoid hardware issues before they start. This hardware memory topic page provides advice from top Windows experts on how to test and upgrade memory on desktop computers and laptops running Windows operating systems such as Windows XP and Windows Vista.

The CPU calls instructions and data from the computer's memory. Because the same computer performs many tasks the memory is erasable (e.g. But there are some programs and instructions which the computer needs. It does not matter what function you are performing. These programs often are permanently recorded in the memory. So they cannot be destroyed.

Due to the mechanics of how memory works, its contents are erased when a computer is powered off. Therefore, the information in memory needs to be acquired when a system is still on, or "live.” The choice an investigator must make when collecting evidence from a "live” system is to determine how to collect volatile data from memory before shutting the system down for forensic preservation of the hard drive.

There are two options available to the forensic investigator. The first option is to use tools that extract information from memory by relying on the operating system. The second option is to acquire the entire contents of memory and analyze its contents using programs only recently developed.

This question really depends on the type of computer user you're and what type of programs you plan on running on the computer. One of the best methods of determining how much RAM you should have is to look at the system requirements of the programs you're running on your computer and double whatever the memory requirements are for the program you use most. However, below is the general recommendation for memory.

Newer computer memory is all DDR--double-data rate memory. By processing data on the upswing as well as the downswing, DDR memory essentially doubles the performance speed. Most systems ship with DDR2 memory, the second generation of double-data rate memory, and a lot of video cards use even faster DDR3 memory.

Collecting the entire contents of memory is both free and easy! Memory can be preserved by using the Defense Computer Forensic Lab Data Dump (DCFLDD). DCFLDD is an enhanced version of the GNU "dd,” with added features to support forensics and security-based operations. DCFLDD is very versatile, and works on Unix, BSD, Linux, and Windows Operating Systems.