Windows – What are the differences between a physical and virtual RAM disk

Here is a eHow page on How to Dump Linux Memory

Linux provides two virtual devices for this purpose, '/dev/mem' and '/dev/kmem', though many distributions disable them by default for security reasons. '/dev/mem' is linked to the physical system memory, whereas '/dev/kmem' maps to the entire virtual memory space, including any swap. Both devices work as regular files, and can be used with dd or any other file manipulation tool.

That leads to the ForensicsWiki page on Memory Imaging Tools with the Linux/Unix section,

1. dd On Unix systems, the program dd can be used to capture the contents of physical memory using a device file (e.g. /dev/mem and /dev/kmem). In recent Linux kernels, /dev/kmem is no longer available. In even more recent kernels, /dev/mem has additional restrictions. And in the most recent, /dev/mem is no longer available by default, either. Throughout the 2.6 kernel series the trend has been to reduce direct access to memory via pseudo-device files. See, for example, the message accompanying this patch: http://lwn.net/Articles/267427/. On Red Hat systems (and derived distros such as CentOS), the crash driver can be loaded to create a pseudo-device for memory access ("modprobe crash").
2. Second Look This commercial memory analysis product has the ability to acquire memory from Linux systems, either locally or from a remote target via DMA or over the network. It comes with pre-compiled Physical Memory Access Driver (PMAD) modules for hundreds of kernels from the most commonly used Linux distributions.
3. Idetect (Linux)
4. fmem (Linux)
   fmem is kernel module, that creates device /dev/fmem, similar to /dev/mem but without limitations. This device (physical RAM) can be copied using dd or other tool. Works on 2.6 Linux kernels. Under GNU GPL.
5. Goldfish
   Goldfish is a Mac OS X live forensic tool for use only by law enforcement. Its main purpose is to provide an easy to use interface to dump the system RAM of a target machine via a Firewire connection. It then automatically extracts the current user login password and any open AOL Instant Messenger conversation fragments that may be available. Law Enforcement may contact goldfish.ae for download information.

See Also: Linux Memory Analysis.
There is also GDB commonly available on most Linuxes.
And, you are always advised to avoid writing over unknown memory -- it can lead to system corruption.

Let's go over the difference between virtual and logical addressing first. I believe the distinction is that "logical address" means that the address the program sees is different from the physical address of the data being stored in RAM.

If you have virtual memory, there may be no physical address at all, as the data stored could be swapped out to disk. However, it is possible to have a system without virtual memory where logical addresses are different from physical addresses, but each logical address is mapped to a physical address. This would make it easier to run multiple programs without them stepping on each other, but wouldn't let the programs use more memory than the physical memory available to the system.

So there is no separate "logical memory" in a computer, though I suppose you could say that a computer with logical addresses but no virtual memory system has a logical memory system. I would just say that logical memory is memory addressed via some indirection method. Is there some specific computer system that you have in mind?

--

Taking your comments into account:

Logical addresses for the same physical memory can be the same or different. Usually two processes won't have access to the same memory, since then one can corrupt the other. However, if they have arranged to use some form of shared memory, they will usually map that shared memory to different addresses. Virtual addresses are more or less a type of logical address, so if you have an operating system that supports VM, and two processes map shared memory, they will usually see that memory as being at different addresses, the same as if there was no virtual memory.

As for your understanding of the purpose of logical vs virtual, virtual memory is for using the HD to extend the memory that you have available to programs. Logical addressing can be used for more than process separation, but that would be one major use.