So obviously its not a foolproof plan but wouldn’t you just dump the RAM while the machine is on? Dont you just copy /tmp or something and analyse that?

I suppose I’m assuming they can get shell access now that I think about it so probably a stupid question