That’s an old method, it’s the same thing you do in normal forensics like doing a savecore which will save all the contents of memory.
But it still only works on disk encryption that unlocks on startup. If you just pgp a certain folder and only unencrypt it when you use it, and not constantly then there’s nothing you can do unless they get it seconds after it’s been decrypted


>One more thing to worry about: http://citp.princeton.edu/memory/
>
>The video explains it very well.