Getting Started with Memory Forensics Using Volatility

Forensic examiners and incident responders must be able to perform memory forensics. In today's world of sophisticated malware and insider threats, it is possible to rely on only dead-box forensics or other security tools, without extracting the important information stored in volatile memory. This can lead to missing key artifacts that are necessary for forensic investigations. This course, "Getting Started with Memory Forensics using Volatility", will give you a solid understanding of the Volatility framework and how to perform memory forensics. You will first learn about Volatility, including how to download and configure it, as well as how to run it. Next, you'll learn how Volatility can be used to perform memory forensics using Windows, macOS and Linux memory images. You will then be able to experience a real-life security incident where we will use volatility to perform memory analysis on an image to determine what happened to the victim host. After completing this course, you will be able to use Volatility to perform memory forensics.