Technical A02 - The Current State of Memory Forensics

The course covers the current state of memory forensics, including the reasons for memory forensics, memory acquisition options, address space layout, memory analysis goals and techniques, process enumeration, network artifact review, file extraction from memory, Windows 10 memory compression, traditional architecture, malware in secure mode, and the relationship between Virtual Secure Mode (VSM) and memory forensics. The course aims to teach memory acquisition tools, analysis techniques, and the impact of Windows 10 features on memory forensics. The teaching method includes video lectures from Louisville InfoSec 2016. This course is intended for individuals interested in memory forensics, cybersecurity professionals, digital forensics analysts, and law enforcement personnel.