Memory and Malware Forensics.

Catalog description

Semester course; 3 lecture hours (delivered online or face-to-face). 3 credits. Enrollment is restricted to graduate students in the College of Engineering or by permission of the instructor. Students should have significant programming experience. The course provides foundation for memory and malware forensics, using the Volatility memory forensics framework, an open source toolkit written in Python. It is focused on investigation of the contents of volatile computer memory (RAM), to reveal hidden malware processes, network connections, clipboard contents, evidence of malware and other malicious evidence. The course will teach skills for analyzing internals of operating systems, such as Mac, Windows and Linux, by concentrating on data structures used by these operating systems.