They use forensic tools to clone the RAM before moving it. Probably depends on exploits so whether it will work may depend on your OS, but they have access to the hardware so there are a lot of possibilities.
For password guessing they make clones of the computer so they can make countless instances of it to endlessly guess the password at the speed of dickheads to get around the systems cutting the guesser off after a number of attempts.