Course Catalog


When my job as a U.S. Secret Service Agent computer forensics examiner requires collecting volatile data, it will be done with confidence gained from attending this course.” (Manning Jeter, ATSAIC – Critical Systems Protection (CID) at US Secret Service.)

The live response and RAM analysis course provided cutting edge digital forensics training which will allow us to obtain and analyze more data, previously unable to be obtained and analyzed,” (Detective Tim Moniot, of the Las Vegas Metropolitan Police / U.S. Secret Service Electronic Crimes Task Force)

Memory Forensics

Do more than just pull the plug!   Learn to:

  • Acquire RAM and other volatile data from live Windows and Macintosh systems, including those that are running but locked
  • Detect and acquire TrueCrypt, PGP®, Safeboot, Bitlocker® and other encrypted containers while they are mounted and still accessible

Extract useful information from Windows and Macintosh memory collections and zoom in on critical data before conducting traditional hard disk analysis.    Our course will enable you to:

  • Recover Internet related artifacts such as browser history, search engine queries, webmail, chat and images
  • Profile processes that were open, terminated, or even hidden from the user
  • Identify malware and gain an understanding of its behavior
  • Analyze Windows Registry artifacts located in RAM to gain a better understanding of how the user utilized the system
  • Create custom password attack dictionaries from the contents of RAM

Course Details

  • 4 days
  • Level of difficulty: Intermediate
  • Participants will receive a professionally bound course manual and a USB hard drive containing selected course materials, software tools, and memory samples

Software Training Bundles now available for Magnet Forensics Internet Evidence Finder.  Contact BitSec at (877) 272-1417 or for more information and up to date pricing.

Register |  Upcoming Courses | Download Course Brochure

Unable to attend one of our scheduled courses?  Contact a BitSec training professional via email at or toll free at (877) 272-1417 to discuss hosting this course at your location.  

BitSec Global Forensics™ has been approved as a registered sponsor on the National Registry of CPE Sponsors confirming our commitment to adhere to standards for the delivery of high quality continuing professional education.  As such, selected courses are eligible for CPE credits.