Surviving Digital Forensics: RAM Extraction Fundamentals
What you'll learn
- Learn why RAM extractions are important to computer forensic investigations
- Learn what types of valuable data may be stored in memory
- Learn what to consider when making the decision to capture RAM
- Get hands on experience using different RAM capture tools
- Learn how to evaluate and benchmark your RAM extraction tools
- Learn how to use INCEPTION to access password protected systems in order to capture RAM
Requirements
- You will need a Windows 7/8 system
- I recommend you use either a virtual machine or test system to do the RAM capture practicals on
- A USB Hard Drive is recommended to use as your RAM collection media (USB flash drives are acceptable)
- All the ram capture tools are open source and provided as part of the class
- You will need to download PALADIN (open source ISO) from SUMURI.COM for the INCEPTION practical
Description
Conducting a RAM extraction as part of the computer evidence collection process is a front line examiner skill which becoming more and more in demand. A system's live memory contains an assortment of valuable forensic data. A computer analyst trained in memory forensics can dig out evidence of hidden malware processes, user activity and encryption keys or password hashes that may be critical to accesses protected data.
This class provides you with the foundation knowledge to help you make better decisions about why or why not to capture live memory. It also gives you hands on experience using a number of freely available RAM capture tools and covers the advanced topic of using Inception.
Learn why RAM extractions are important and how the data can affect your case.
Practical exercises give you hands on experience with different RAM extraction tools.
Learn how to evaluate and benchmark your RAM capture tools.
Learn how to use PALADIN to launch INCEPTION to gain access to password protected systems in order to extract RAM.
Learn all of this in about one hour using all freely available tools.
Who this course is for:
- This course is designed for computer forensic examiners that conduct on-scene triage and data collection
- This course is appropriate for IT professionals that wish to learn more about RAM extraction fundamentals and tools
- This course is appropriate for students that wish to learn more about RAM extraction fundamentals and get experience with RAM capture tools
Instructor
- 4.5 Instructor Rating
- 2,871 Reviews
- 8,923 Students
- 17 Courses
Over 20 years of experience in Digital Forensics and Security Incident Response. Investigations span corporate (Fortune 500) incident response, technical litigation support for civil and criminal cases, and e-discovery. Author and developer of computer forensic training and analysis tools. Specialties include Windows forensics, Linux forensics, Mac forensics, & mobile device forensics.
Certifications include: C|EH, CFCE, CISSP, EnCE, CCE