Uhh, you do not strictly need physical access. Simple scenarios:

Remote administrative access, does a memory dump.

Laptop or desktop system that supports suspend mode, when in suspend the
contents of memory are written to the harddrive. When brought out of suspend
this data is "deleted" (i.e. the ...

[ more ]