The most trusted source for computer security training, certification and research.

select a course
Washington, DC - December 11 - 18, 2009
Global Information Assurance Certification

This course has been a career changing event. I will be approaching the way I manage in a whole new mind set
-Steve Hoevernaar, Kroger

SECURITY 526

Advanced Filesystem Recovery and Memory Forensics

Thursday, December 17, 2009 : 9am - 5pm
Rob Lee, SANS Faculty Fellow
6 CPE Credits Per Day

This advanced course is perfect for the diligent student familiar with core forensic methodology and techniques. If you understand forensic filesystem fundamentals, then this course is for you. It moves quickly from covering memory forensics to recovering and discovering deleted partitions from hard drives. This course focuses on innovative forensic techniques and methodologies so the seasoned practitioner can keep his skills sharp and up-to-date with the latest research areas in both live and static based disk forensics.

You will receive:

  • Forensic analysis workstation VMware machine equipped to investigate forensic data
  • Course DVD loaded with case examples, tools, and documentation

Prerequisites: This advanced course is perfect for the diligent student conversant with file system forensic techniques. If you are just beginning in digital forensics, this course is not appropriate for you, as the basics of digital forensics will not be covered.

NOTE: The SANS Investigative Forensic Toolkit (SIFT) Essentials are available at an extra cost with purchase of this course.

Tuition includes the SANS Customized Hard Drive Recovery Kit, designed to ensure that you will be able to apply our training the day you get back to the office.

  • Who Should Attend
    • System administrators and incident handling personnel who are trying to further their knowledge in the latest forensic techniques
    • Anyone who wants to learn how file system partitions are structured
    • Anyone who wants to learn how to recover lost partitions from a physical disk image
    • Anyone who wants to learn how to forensically recover artifacts from memory collected from a machine.
  • A Sampling of Topics
    • File system structures and metadata
    • Partitioning schemes
    • Mapping out disk partitions by hand
    • Discovering lost partitions from a formatted drive
    • Windows memory structures
    • Following Microsoft Windows memory process
    • The usefulness of collecting memory
    • Techniques to collect memory
    • Memory analysis techniques

Excellent Training, Top Notch.
-Dennis Dragos, NYPD

Author Statement

One of the most exciting areas in digital forensics is the ability to image and scrutinize physical memory collected from a live system. Starting with discovering basic memory structures, the student will learn how to recover and analyze processes that were seized from a live Windows-based system. Additionally, the student will learn how to discover and recover deleted partitions from hard drives that have corrupted partition tables or that have been formatted. Finally, new techniques in digital forensics will be covered. In the ever-changing world of digital forensics, it is essential that the prepared investigator have the right knowledge combined with new techniques.
- Rob Lee