Training Registration

Reconstructing User Activities from a Memory Dump
On Demand
Duration: 75 Minutes

Recorded on July 6, 2022

This training is intended for U.S. Criminal Justice Practitioners. Please register using your agency-issued email.

Child exploitation cases often involve analyzing digital device storage drives to reconstruct user activities. While much can be learned from disk analysis, Random Access Memory (RAM) is a particularly rich source of potential evidence related to user activities. Specifically, reconstruction of user activities from a RAM dump can help establish both a suspect's awareness and intent. This webinar will cover RAM basics, acquisition, triage, and user-activity reconstruction from a RAM dump. We will demonstrate free tools and analysis with Volatility.

Presented by:
Dr. Joshua James, Freelance Digital Forensic Scientist, DFIR Science, LLC

NW3C does not share webinar attendees’ personally identifiable information with any third party without opt-in consent given during registration.

The content, views, and opinions expressed in this presentation are those of the individual presenters and do not represent official policy, position, opinions, or views of NW3C.


Affirmation of Eligibility
By checking this box, I attest that the subject of this training is related to my work and that I am employed:

(Limit 100 character max.)



NW3C Privacy Statement
Yes, I have read, understand, and agree with the NW3C privacy statement.

OPTIONAL: Check this if you agree that NW3C may share my Personally Identifiable Information.
I agree that NW3C may share my Personally Identifiable Information, including, but not limited to, my email address, with third-party vendors in connection with this NW3C product in accordance with NW3C’s privacy statement.