Live Forensic Volatile Data Capture

From Date To Date Location Status Action
 
 Contact FDR for next available course date.

Location : Toronto Ontario
Tution : $995 CDN (plus applicable taxes)
Training Level : Intermediate/advanced
Training Duration : 2 Days
Training Location Description : FDR training facility or client site Traditionally the approach to the forensic examination of digital media during search and seizure has focused on the “pull the plug” concept. This concept is based on the fact that any power connected to the suspect machine would be disconnected and the suspect computer would then immediately be frozen in time. This concept was at the expense of any volatile information which, unless written to disk before the power was pulled, was lost forever.
Objective : This Live Forensic Volatile Data Capture and Analysis course is designed to equip the student with the knowledge, tools and expertise to successfully capture the “best evidence” volatile information from a running Windows and Linux computers and be able to interpret the results of the live analysis.

This is a fast paced hands-on course and each student will have the opportunity to learn about the core concepts of memory collection and analysis and gain valuable experience by deploying the tools against running systems.

The course will cover;
- An overview of the Windows memory structures
· Live Windows and Linux volatile data capture
· Windows and Linux memory capture
· Unlocking a locked box using memory analysis techniques
· Windows memory analysis to recover;
- System information including , running processes, open files and operating system information
- Recovery of encryption keys
- Usernames and passwords
- Open files
- Registry files
- Email and web artifacts

FDR Forensic Data Recovery Inc.

FDR - Canada's leader in digital investigations and eDiscovery professional services. FDR consistently supports best practices in the preservation, recovery, analysis and court-ready reporting of digital evidence.

Our unparalleled digital investigation expertise and 24/7 response capability assures our clients the most comprehensive, timely and cost-effective professional services.

Training Information

Course Schedule & Registration
Payment & Cancellation Policy
Training Delivery at Your Location

Contact FDR

Toll-free 1.866.381.9700

training@forensicdata.ca