well, when wannacry was around, you could "salvage" the decryption key from an infected machine before it was rebooted.
not saying your idea is bad advice but you need the full picture to counter ransomware attacks
not saying your idea is bad advice but you need the full picture to counter ransomware attacks
dd if=/dev/mem of=~/mem.img