Memory forensics begins with acquisition. In this first part of our series, we walk through capturing volatile memory on Windows using FTK Imager, ProcDump, and crash dumps. Learn how to choose the right dump type, preserve evidence integrity with hashing, and apply best practices for real-world investigations.