Size a RAM capture including page and swap files, compression and the working space a volatile-memory analysis actually needs.
A raw memory image is essentially the size of installed RAM, because the tool walks the full physical address space including device-mapped and unallocated regions. Adding the page or swap file is what makes the capture complete — evicted process pages live there — and a hibernation image adds roughly three quarters of RAM again. Zeroed pages compress to nothing, so the stored size depends far more on how much of RAM is actually in use than on the compression level chosen. Teams routinely arrive with a 64 GB USB stick to capture a 256 GB server and lose the volatile evidence entirely; the capture either does not fit or does not finish before the process they were chasing exits.
Memory Dump Size
rawCapture = installedRAM + pageFile (if captured) + 0.75 × RAM for a hibernation image; storedSize applies the compression ratio only to the non-zero pages.
Working space for analysis
analysisWorkingSpace ≈ 1.6 × rawCapture, covering the decompressed image plus extracted processes, strings and carved artefacts.
rawCapture = installedRAM + pageFile (if captured) + 0.75 × RAM for a hibernation image; storedSize applies the compression ratio only to the non-zero pages. A raw memory image is essentially the size of installed RAM, because the tool walks the full physical address space including device-mapped and unallocated regions. Adding the page or swap file is what makes the capture complete — evicted process pages live there — and a hibernation image adds roughly three quarters of RAM again. Zeroed pages compress to nothing, so the stored size depends far more on how much of RAM is actually in use than on the compression level chosen.
Teams routinely arrive with a 64 GB USB stick to capture a 256 GB server and lose the volatile evidence entirely; the capture either does not fit or does not finish before the process they were chasing exits.
This calculator takes 7 inputs: Installed RAM, Page or swap file size, Capture the page or swap file too, Capture hiberfil.sys or the hibernation image, Zero or unallocated pages, Capture compression, Write rate to the evidence target. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Yes, if you care about what was in memory but is no longer resident. Decrypted keys, credential material and command lines routinely get paged out, and a RAM-only capture silently misses them.
Because analysis expands the data. Volatility and similar tools decompress the image, then write out process dumps, injected-code regions, extracted files, strings and timelines — collectively about 60% of the image size again.