Introduction to Memory Analysis with Volatility
*(ISC)² Members/Associates can access this course for free by logging in above and clicking the 'My Courses' menu item.
Analyzing a suspect system "live", before disconnecting it and imaging the disks, often yields valuable forensic evidence. Further, it can help determine whether a crime has been committed at all, or whether a system contains evidence at all, thereby avoiding time-consuming examination of irrelevant machines. The Volatility® framework is the dominant open-source memory analysis framework, examining RAM snapshots from a large variety of operating systems in multiple formats. This Hand-On Lab course will introduce you to the process of capturing a live RAM image and analyzing it using Volatility. You will learn about several Volatility plugins for analyzing a Windows memory image, then analyze actual RAM images, including one with active malware, and view the results.
This course includes the following six (6) labs: 1) Get Started with Volatility 2) Examine Running Processes, DLLs, and Commands 3) Analyze Network Activity 4) Analyze the Windows Registry 5) Search for Malware Artifacts 6) Use Volatility's Forensic Analysis Tools
Audience or Who Should Take This Course
Experienced cyber, information, software and infrastructure security professionals who better want to understand the process for capturing a live RAM image and analyzing it using Volatility.
Familiarity with security concepts.
How This Course Works
Lab content within this course take place within a Windows 10 64bit virtual machine. Before each lab topic, you will be asked to watch an instructional video that will guide you through the content and review the necessary background information to complete the lab assignment. There is no time restriction, but this lab will take approximately two hours to complete. The exercises are intended to be completed in sequential order, and all elements within the lab are required to complete the course.
At the end of the course, you will be asked to take a final assessment. Please note that you must score 70% or higher on the final assessment and complete the course evaluation prior to receiving a certificate of completion and earning (2) continuing professional education (CPE) credits.
Please make sure at the end of the course that you download and retain the certificate of completion as proof of credits earned. CPEs earned for this course may be eligible for continuing professional education credits for non-(ISC)² certifications. Please visit the continuing education requirements established by the credentialing organization for eligibility.