Why is it that most conventional applications are incapable of copying live memory from a computer system?
◦ They're not incapable. It's easy to capture memory.
◦ Because memory is constantly shifting. The mere fact that you are copying the memory causes it to change.
◦ Because direct access to system memory requires a kernel-mode procedure call. Most applications only have user-mode access.
◦ Because system memory is not part of the regular file system.