This paper gives an overview of all known “live” memory collection techniques on a Windows system, and freely available memory analysis tools. Limitations and known anti-collection techniques will also be reviewed. Analysis techniques will be illustrated through some practical examples, drawn from past forensics challenges. This paper is forensics-oriented, but the information provided information will also be of interest to malware analysts fighting against stealth rootkits.