Talk With an Expert

Extracting the Unseen: Real-World RAM Acquisition and Analysis from Android Devices

Extracting the Unseen: Real-World RAM Acquisition and Analysis from Android Devices (PDF, 4.65MB)Last updated: 28 Sep, 2025
Presented by:
Alex Coley
Alex Coley

Volatile memory on Android devices often contains critical evidence — Encryption keys, credentials, and transient user data that traditional extractions miss. This session demonstrates real-world RAM acquisition and analysis, showing how to safely recover, interpret, and correlate volatile artifacts with static data. This session will offer you a clear view of practical workflows, essential tools, and actionable tips to enhance mobile forensic investigations

SANS DFIR Europe Prague 2025