When would you capture memory rather than just disk, and what do you expect to find?

Capture memory whenever the suspected activity is fileless, encrypted or injected, and always before you power down or isolate in a way that ends the session. Memory yields running processes and their parents, injected code, decrypted payloads and configuration, active network connections, loaded modules and often credential material. Follow order of volatility (memory and network state first, then disk) and hash everything as you collect it.

My trigger is anything suggesting the malicious code is not sitting on disk in readable form: injected threads, packed or encrypted payloads, script based execution, or a live command and control session. In those cases the disk copy tells me very little and memory tells me almost everything. I follow order of volatility, so memory and current network connections first, then the disk image, because isolating or shutting down destroys the volatile side. From an image I expect running processes with parents and command lines, injected or hollowed regions that do not map to a file on disk, decrypted configuration including command and control addresses, network connections tied back to a process, and often credential material. I collect with a signed tool from removable media, write to an external target, hash immediately, and record the exact steps and timestamps in the case notes. On one investigation the only place the command and control domain existed was a memory string, because the loader pulled it down and never wrote it anywhere.