you dump the physical memory, then decrypt the disk offline