Investigate a memory question with a snapshot
Task Manager shows that memory is being used, but it may not explain why a large amount belongs to cached files or system allocations. RAMMap gives you a more detailed view of physical memory. Mark Russinovich’s Microsoft Sysinternals utility separates allocation categories, process working sets and file-backed pages. It is intended to help you understand a particular state of Windows, rather than turn every occupied byte into a problem.
Think of the display as a set of views of the same system. Use Counts summarises allocation types and page-list states. Processes shows working sets associated with processes. File Summary helps identify file data currently represented in memory. These numbers answer different questions and should not simply be added together as if each tab described a separate pile of RAM.
Cached memory is not automatically wasted memory
Windows can use otherwise available memory to retain data that may be needed again. A large standby or file-cache figure does not by itself prove a leak. Look at the workload and whether the computer actually experiences memory pressure, paging or application failures. Clearing a cache to make a screenshot look emptier can remove useful data and make the next access require more work.
RAMMap includes detailed views of physical pages and ranges for deeper investigations. If those terms are unfamiliar, start with the summaries and the official documentation. Avoid using memory-emptying commands as a routine speed-up ritual. A temporary change in a counter does not establish that a leak has been repaired or that the application responsible has changed its behaviour.
Compare before and after one activity
Open the program before reproducing a suspicious task and save a snapshot. Run the task, refresh the display and save another snapshot with a descriptive filename. Record which program and files were involved and how long the operation lasted. The ability to load saved snapshots helps you return to an observation without relying on recollection of a number that was briefly on screen.
For example, compare the state before opening a large dataset and after closing the application. Some data may remain cached, which differs from a growing process working set. Repeat the same sequence if the pattern matters. Do not attribute all memory left in use to the last application you happened to close. Drivers and Windows itself also allocate physical memory.
Download and run the Microsoft utility
The official page lists Windows Vista and later, and Windows Server 2008 and later. RAMMap is available free under the Sysinternals license; it is not a paid cleaner with an activation requirement. Download its ZIP from Microsoft, extract it to a normal folder and launch the executable appropriate for your system. Read the license prompt and allow the elevation required for inspecting system information.
There is no need to install an unrelated optimiser alongside it. Keep saved snapshots somewhere you can find again and review their contents before sharing them. HWiNFO can confirm installed hardware capacity when that is the question. Autoruns helps investigate what starts automatically if unwanted background software is involved. RAMMap answers the narrower allocation question and does not replace testing a suspected faulty memory module or correcting a leaking driver.
