RAM · Memory forensics training with Volatility
Acquire and analyse RAM from live machines: live forensics and incident response, memory imaging, Windows artefacts from memory, password recovery and in-depth work with the Volatility framework.
During this course, participants will learn how to deal with live computer data and how to analyze it. Differences between regular “dead-box” investigations and investigations on live machines will be explained in detail, with focus on RAM analysis. Main task during this class is to teach the participants different ways of how to acquire Random Access Memory or RAM, of a live machine and how to analyze it with various tools. The class will show how much data is actually stored in RAM, how to extract it and use it in everyday digital forensic investigations. In comparison to the other RAM related classes, this class is exclusively designed for digital forensic investigators and shows different ways of how RAM data can aid them in their investigations. The participants will go through live forensics and incident response procedures, imaging RAM, RAM analysis with various tools and approaches, restoring and analyzing various Windows related artifacts through RAM forensics, advanced topics on how RAM works in Windows OS environments, password recovery and data decryption and in-depth approach to Volatility framework for RAM analysis. The class is based on extensive hands-on exercises that take the participants through the aforementioned topics.
Digital forensic investigators who want to use live data and RAM analysis in everyday investigations.
After finishing this course, participants will:
To obtain the maximum benefits from this class, participants should have good knowledge of computer forensic investigations and acquisition procedures, be familiar with command line and terminal use.
Every participant who passes the course receives an official e-DiFTA certificate confirming successful completion of the class and recognising the training hours completed.
At the end of the course, the students will undergo a knowledge evaluation based on a real case scenario. After successful completion of the evaluation, participants will receive an official certificate for attending and passing the course.
Head of Digital Forensics Department, INsig2
Krešimir is the head of the Digital Forensics Department at INsig2. He has extensive experience in both the public and private sector, where he has contributed to various programmes and clients. His main tasks involve team and project management,…
Yes. At the end of the course participants complete a knowledge evaluation based on a real case scenario. After passing it, they receive an official certificate for attending and passing the course.
Attendance is intended exclusively for law enforcement personnel, military personnel engaged in digital forensic activities and private-sector investigators.
Five days of hands-on training (08:00–17:00), an official certificate of successful completion recognising the training hours, a buffet lunch and morning and afternoon coffee breaks every day.
Seats are limited and allocated on a “first paid – first confirmed” basis. Your registration is confirmed once payment is received; the payment deadline is 25 December 2026.
Yes. Every participant who passes the course receives an official e-DiFTA certificate confirming successful completion of the class and recognising the training hours completed.
Invoices are issued from France. Private individuals and organisations in France pay French VAT (20%). Organisations outside France are invoiced without French VAT when they provide a valid VAT number, TIN or EIN. Full VAT rules.
Learn to use AI and large language models as investigative tools – and to recognise how criminals misuse them – with hands-on work on LLMs, RAG systems, AI agents and the EU AI Act.
Hands-on intermediate course in advanced Android and iOS analysis: OS internals, encryption, manual SQLite and plist parsing, cloud artefacts and validating what your tools report.
Practical open-source intelligence for investigators: a secure OSINT environment, advanced search, SOCMINT, breach data, metadata, image verification, geolocation, the dark web and evidential reporting.
Expert-level Windows 11 forensics over five days: BitLocker, WSL and Sandbox, Registry and user activity, Helium apps, OneDrive, Chromium browsers and SQLite exploitation.
