When you are going to take control over a machine you have physical access to while it is running, you should always dump memory because it might, among other t

When you are going to take control over a machine you have physical access to while it is running, you should always dump memory because it might, among other things, contain disc encryption keys.