Skip to content
ENExplore Calculators

Memory Dump Size Calculator

Size a RAM capture including page and swap files, compression and the working space a volatile-memory analysis actually needs.

About Memory Dump Size Calculator

A raw memory image is essentially the size of installed RAM, because the tool walks the full physical address space including device-mapped and unallocated regions. Adding the page or swap file is what makes the capture complete — evicted process pages live there — and a hibernation image adds roughly three quarters of RAM again. Zeroed pages compress to nothing, so the stored size depends far more on how much of RAM is actually in use than on the compression level chosen. Teams routinely arrive with a 64 GB USB stick to capture a 256 GB server and lose the volatile evidence entirely; the capture either does not fit or does not finish before the process they were chasing exits.

Formulas

Memory Dump Size

rawCapture = installedRAM + pageFile (if captured) + 0.75 × RAM for a hibernation image; storedSize applies the compression ratio only to the non-zero pages.

installedRAM
Physical memory the acquisition tool must read
pageFile
pagefile.sys or the swap partition
zeroPct
Share of pages that are zeroed and compress to almost nothing

Working space for analysis

analysisWorkingSpace ≈ 1.6 × rawCapture, covering the decompressed image plus extracted processes, strings and carved artefacts.

rawCapture
Uncompressed size of the memory image

Worked example

With the default values below, Memory Dump Size Calculator returns Raw Capture Size of 160.0. Change any input above and every figure here is recalculated in your browser.

Inputs used

Installed RAMaccepts 0.5–8,192 GB
128 GB
Page or swap file sizeaccepts 0–8,192 GB
32 GB
Capture the page or swap file too
Yes
Capture hiberfil.sys or the hibernation image
No
Zero or unallocated pagesaccepts 0–90 %
25 %
Capture compressionone of None — raw padded image — 1.0×, LZ4 or fast stream compression — 1.8×, Zstd level 3 — 2.6×, Zstd level 12 — 3.4×
LZ4 or fast stream compression — 1.8×
Write rate to the evidence targetaccepts 1–8,000 MB/s
200 MB/s

Results

Raw Capture Size
160.0 GB
Stored Compressed Size
66.7 GB
Analysis Working Space
256.0 GB
Capture Time
13.7 minutes
Total Evidence Footprint
322.7 GB
Acquisition Note
Page file included — that is where evicted secrets and keys often survive

Step by step

  1. 1Values used
  2. 2Memory Dump Size
  3. 3Working space for analysis
  4. 4Raw Capture Size= 160.0 GB
  5. 5Stored Compressed Size= 66.7 GB
  6. 6Analysis Working Space= 256.0 GB
  7. 7Capture Time= 13.7 minutes
  8. 8Total Evidence Footprint= 322.7 GB
  9. 9Acquisition Note= Page file included — that is where evicted secrets and keys often survive

Assumptions and limits

  • The result is derived only from the 7 inputs listed above. Anything not among them is not part of the calculation.
  • In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
  • Figures are rounded for display to 1 decimal place, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

How is Memory Dump Size calculated?

rawCapture = installedRAM + pageFile (if captured) + 0.75 × RAM for a hibernation image; storedSize applies the compression ratio only to the non-zero pages. A raw memory image is essentially the size of installed RAM, because the tool walks the full physical address space including device-mapped and unallocated regions. Adding the page or swap file is what makes the capture complete — evicted process pages live there — and a hibernation image adds roughly three quarters of RAM again. Zeroed pages compress to nothing, so the stored size depends far more on how much of RAM is actually in use than on the compression level chosen.

Why does Memory Dump Size matter?

Teams routinely arrive with a 64 GB USB stick to capture a 256 GB server and lose the volatile evidence entirely; the capture either does not fit or does not finish before the process they were chasing exits.

What values do I need to enter?

This calculator takes 7 inputs: Installed RAM, Page or swap file size, Capture the page or swap file too, Capture hiberfil.sys or the hibernation image, Zero or unallocated pages, Capture compression, Write rate to the evidence target. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Do I need the page file if I already have RAM?

Yes, if you care about what was in memory but is no longer resident. Decrypted keys, credential material and command lines routinely get paged out, and a RAM-only capture silently misses them.

Why is the working space larger than the image?

Because analysis expands the data. Volatility and similar tools decompress the image, then write out process dumps, injected-code regions, extracted files, strings and timelines — collectively about 60% of the image size again.

Related Calculators

Memory Dump Size Calculator – Calculate Raw Capture Size