画布 1
内存提取
  硬提取
    基于 PCI 卡拷贝物理内存 (hardware card based technique)
    基于 IEEE 1394 火线接口拷贝物理内存 (hardware bus based technique)
    基于固件的物理内存拷贝 (firmware based technique)
    基于网卡拷贝物理内存 (network card based technique)
    基于雷电接口 Thunderbolt 拷贝物理内存 (Thunderbolt based technique)
  软提取
    Windows
      hiberfil.sys
      MEMORY.DMP
      内存dump
        moonsols
        Belkasoft RAMCapturer
        Magnet RAM Capture
        Winpmem
        FTK Imager
        AvDump
        Redline
    Mac
      内存dump
        osxpmem
        MacMemoryReader
        Recon for Mac OSX
        Blackbag MacQuisition
    Linux
      内存dump
        LiME
          lmg
        linpmem
        Draugr
        Volatilitux
        Memfetch
        Memdump
        fmem
    Vmware
      vmss
        vmss2core
      vmsn
        vmss2core
      vmem
        vmss2core
        Volatility
        Bin2Dmp
    VirtualBox
      相关工具
        vboxmanage
        vboxelf2raw