CSCI 4538 - Memory Forensics

Prerequisites: CSCI 3320, CSCI 3338, CSCI 3351. This course provides students with the theoretical and practical foundations necessary for the investigation of volatile memory. The discipline of digital forensics will be discussed and outlined with emphasis on the sub-discipline of memory forensics. Students will learn the techniques of acquiring digital evidence from volatile memory and analyzing it. Topics covered include: the volatility framework, Windows memory forensics, Windows objects and pool allocations, processes, handles and tokens, process memory internals, hunting malware in process memory, event logs, registry in memory, networking, Windows services, kernel forensics and rootkits, Windows GUI subsystems, disk artifacts in memory, event reconstruction and timelining. 3 credits.