Surviving Digital Forensics: RAM Extraction Fundamentals

Learn how to apply RAM extraction basics and get hands on experience using RAM capture tools - including Inception

Created by: Michael Leclair
DFIR Professional

What Will I Learn?

• Learn why RAM extractions are important to computer forensic investigations
• Learn what types of valuable data may be stored in memory
• Learn what to consider when making the decision to capture RAM
• Get hands on experience using different RAM capture tools
• Learn how to evaluate and benchmark your RAM extraction tools
• Learn how to use INCEPTION to access password protected systems in order to capture RAM

Requirements

• You will need a Windows 7/8 system
• I recommend you use either a virtual machine or test system to do the RAM capture practicals on
• A USB Hard Drive is recommended to use as your RAM collection media (USB flash drives are acceptable)
• All the ram capture tools are open source and provided as part of the class
• You will need to download PALADIN (open source ISO) from SUMURI.COM for the INCEPTION practical

Target audience

• This course is designed for computer forensic examiners that conduct on-scene triage and data collection
• This course is appropriate for IT professionals that wish to learn more about RAM extraction fundamentals and tools
• This course is appropriate for students that wish to learn more about RAM extraction fundamentals and get experience with RAM capture tools