Glossary: Incident Response and Resilience

memory dump

Also written: full memory dump

A copy of a computer's RAM saved to a file. It is the most volatile evidence and often holds what never touches the disk, like the attacker's address and the ransomware key.