A memory dump is a forensic capture of the contents of a device’s RAM at a specific moment. Captures running processes, decryption keys loaded into memory, recently-accessed files, network connections, clipboard contents, and the working state that disappears the instant the device powers off. Acquired via specialized tools (Magnet RAM Capture, FTK Imager, Volatility framework for analysis) on running devices.
What it means in practice
The memory dump is what makes AFU-state extraction qualitatively different from BFU. In AFU, the disk-encryption keys are in RAM; capturing RAM lets the analyst extract those keys and decrypt the storage even if the device is later powered off. The dump also captures messaging-app session keys, cryptocurrency wallet seeds if loaded, Signal protocol session state, browser cookies and active sessions, recent typed passwords, and anything else the user has touched recently. The structural defense is BFU: a powered-off device has nothing useful in RAM, and the keys are derived only from the passcode at next boot. The operational rule: power off before any anticipated seizure if the threat tier includes memory-aware forensic capability.
Who uses it, and against whom
Used by: incident-response teams during active intrusions (the malware in memory is sometimes the only artifact left, particularly for fileless attacks), federal forensic labs against high-priority seized devices, advanced corporate investigators in suspected data-exfiltration cases, and academic and commercial security researchers analyzing live samples. The capability is rarer at the consumer-forensic tier (most local police labs do not run memory acquisition routinely) but is standard at the federal and high-end commercial tier. The threat scales with adversary sophistication; for most readers the BFU rule is the operational defense, and the underlying memory-acquisition capability is the reason BFU matters.
What you can change today
The single rule: power off the device fully before any context where seizure is plausible. Lock screen does not change RAM state, only full power-off does. On iPhone: hold the side button and one volume button until “slide to power off” appears, then slide. On Android: power button menu, Power off. The next boot is BFU; do not unlock until you actually need the device. For high-target operators: keep the device powered off whenever it is not actively in use, treat the power-on as the operational decision rather than the default state. The discipline trades convenience for forensic resistance, which is the right trade in adversarial scenarios and the wrong trade in normal life. The threat model determines which trade is current.