![]() The course will consist of lectures on specific topics in Windows, Linux, and Mac OS X memory forensics followed by intense hands-on exercises to put the topics into real world contexts. ![]() This course demonstrates why memory forensics is a critical component of the digital investigation process and how investigators can gain the upper hand. The only way to turn-the-tables and defeat a creative digital human adversary is through talented analysts. Malicious adversaries have been leveraging this knowledge disparity to undermine many aspects of the digital investigation process with such things as anti-forensics techniques, memory resident malware, kernel rootkits, and encryption (file systems, network traffic, etc.). Volatile memory contains valuable information about the runtime state of the system, provides the ability to link artifacts from traditional forensic analysis (network, file system, registry), and provides the ability to ascertain investigative leads that have been unbeknownst to most analysts. ![]() Unfortunately, digital investigators frequently lack the training or experience to take advantage of the volatile artifacts found in physical memory. ![]() The ability to perform digital investigations and incident response is a critical skill for many occupations.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |