Memory Acquisition and Examination
In this hands-on lab, you will learn the basics of memory forensics. You will practice acquiring and examining evidence from system memory on a Windows system.
Course Content
Upon completing this lab, you should be able to:
- Define core terms associated with memory acquisition and analysis.
- Describe the order of volatility and its impact on when we acquire memory.
- Acquire a memory dump from a Windows system using winpmem and FTK Imager.
- Examine a memory dump using Volatility to extract basic information, such as a list of running processes and active network connections.
Instructed by
After too many years of security operations work, Chris Daywalt tries to turn his phone off at 5:00 pm EST. While there are a bunch of training classes and education somewhere on his resume, much of what he has to teach was learned at the school of hard knocks, often at the expense of his previous clients. He wants to help you spend more time detecting and denying adversaries and less time banging your head against your keyboard. He dips his blueberry donuts in orange juice.
Chris’ 19-year career includes work for organizations of all sizes, both government and private sector, and is distributed roughly like so:
