MEMORY FORENSICS IN WINDOWS

Catalog description

This course covers the theory and practice of digital forensic analysis for Windows memory. It explores the evidence of program execution from memory, Windows process genealogy, acquiring memory, collecting string from memory, extracting malware from memory, and the importance of hibernation files for memory forensic investigation. The course also reviews various memory forensic tools that assist in conducting a comprehensive memory forensic analysis on Windows operating systems. (3 credit)