Part 8 - Volatile Memory Capture | Cybrary

NEED TO TRAIN YOUR TEAM? LEARN MORE

Did you know Cybrary's video training is FREE? Join more than 2,500,000 IT and cyber security professionals, students, career changers, and more, growing their careers on Cybrary.

Time

12 minutes

Difficulty

Intermediate

Video Activity

This lesson covers volatile memory capture. There are numerous programs to accomplish this; some of the well-known ones are: · FTK Imager · DumpIT · Mandiant Redline The best practice is to use removable media ...

NEED TO TRAIN YOUR TEAM? LEARN MORE

Did you know Cybrary's video training is FREE? Join more than 2,500,000 IT and cyber security professionals, students, career changers, and more, growing their careers on Cybrary.

This lesson covers volatile memory capture. There are numerous programs to accomplish this; some of the well-known ones are: · FTK Imager · DumpIT · Mandiant Redline The best practice is to use removable media with installed software, which captures virtual memory while not adding files which causes valuable data to be overwritten. After the data is collected; the following takes place: · Disk encryption · Forensic imagining · Volatile memory analysis · Analysis of data Reporting

Part 1 - An Overall View of the Course

Part 2 - The Humans Behind Cyber Security Incidents

Part 3 - The Sony Hack Case Study

Part 1 - An Overview of Incident Response Policy

Part 2 - The Elements of an Incident Response Policy

Part 3 - The Role of Communication with Law Enforcement when it comes to security

Part 4 - The Different Types of Incident Response Teams

Part 5 - Outsourcing Considerations

Part 6 - The Role of the Incident Response Manager

Part 7 - What does an Incident Response team do?

Part 1 - An Introduction to Incident Handling

Part 2 - CIRC Team Composition

Part 3 - Incident Response Policies

Part 4 - The REACT Principle

Part 5 - Maintaining the Integrity of the Scene following an incident

Part 6 - The Content of Notice

Part 7 - The Respond Part of Incident Response

Part 1 - An Introduction to legal considerations of incident response

Part 2 - Expectation of Privacy

Part 3 - Personally Identifiable Information (PII)

Part 4 - Giving notice to individuals

Part 5 -Benefits of Information Sharing

Part 1 - Forensics in Support of an Incident Response

Part 2 - The Phases of Investigation

Part 3 - The Preservation Phase of Investigation

Part 4 - Keys of Preservation

Part 5 - Volatile Data Considerations

Part 6 - Capturing the data

Part 7 - Imaging concepts

Part 8 - Volatile Memory Capture

Part 9 - Forensics in Support of Incident Response

Part 10 - Formatting a disk for Incident Response

Part 11 - Using the FTK Imaging Software

Part 12 - The Forensic Acquisition of Data from a PC

Part 13 - Navigating the H Drive

Part 14 - Obtaining the Windows Bitlocker Encryption Keys

Part 15 - Obtaining the Windows Bitlocker Encryption Keys (continued)

Part 16 - The Autopsy Program

Part 1 - What is Insider Threat?

Part 2 - American Superconductor Case Study

Part 3 - Indicators to identify an insider threat

Part 4 - Using Automated processes to look for indicators of in insider threats

Part 5 - Policy Enforcement

Part 6 - Policies and procedures

Part 7 - Policies and procedures (continued)

Part 8 - Policies and procedures (continued)

Part 1 - Malware incidents

Part 2 - Setting up a Virtual Machine

Part 3 - Dynamic Analysis

Part 1- Incident Recovery

Part 2 - Resiliency: The Answer to the Cyber Security Paradox

Introduction to SIEM

Responding to Cyber Security Incidents

Mastering Cyber Attribution

Incident Response & Advanced Forensics