Skip to content
UdemyHackingPaid courseAll LevelsCertificate

SDF: Memory Forensics 1 (Udemy.com)

Learn Windows memory forensics

Created by: Michael Leclair

Last updated February 2019

icon
What you will learn

  • Learn how to use Volatility
  • Learn to do a fast-triage compromise assessment
  • Understand plugin output for investigations
  • Learn the value of Windows core processes for exams

How it compares

Against the other 523 rated Udemy courses in Hacking on CourseDuck:

  • Rating4.6 out of 5higher than 72% of them
  • Reviews607#249 of 524 by number of reviews
  • Length1.8 hoursshorter than 86% of them
  • Last updatedFebruary 2019earlier than 89% of them

icon
Course Description

*** COURSE COMPLETELY REWRITTEN AND UPDATED 2019 ***

Learn to use Volatility to conduct a fast-triage compromise assessment.

A system's memory contains an assortment of valuable forensic data. Memory forensics can uncover evidence of compromise, malware, data spoliation and an assortment of file use and knowledge evidence - valuable skills for both incident response triage work as well as in digital forensic exams involving litigation.

This class teaches students how to conduct memory forensics using Volatility.

  • Learn how to do a fast-triage compromise assessment

  • Learn how to work with raw memory images, hibernation files and VM images

  • Learn how to run and interpret plugins

  • Hands-on practicals reinforce learning

  • Learn all of this in about one hour using all freely available tools.

icon
Udemy Discount

The discount is applied through our link. Open the course from here and Udemy's current promotional price is applied at checkout on most courses, no code to type.

Some courses are excluded from Udemy's promotions. If the price does not drop, clear your browser cookies and use the button again.

icon
Instructor Details

Michael Leclair

Over 20 years of experience in Digital Forensics and Security Incident Response. Investigations span corporate (Fortune 500) incident response, technical litigation support for civil and criminal cases, and e-discovery. Author and developer of computer forensic training and analysis tools. Specialties include Windows forensics, Linux forensics, Mac forensics, & mobile device forensics.

Certifications include: C|EH, CFCE, CISSP, EnCE, CCE

icon
More Hacking courses

$109.99

$27.99

$14.99

$84.99

$15.99

$11.99

icon
Reviews

4.6

607 ratings on Udemy

Select a bar to show only those reviews.Select the bar again to show every rating.

By Jeannick IHOUELE on 5/4/2025

Thank you, Michael, for the "SDF: Memory Forensics" course. It was clear, practical, and very well-structured. I especially appreciated the hands-on focus and the tool demonstrations. I now feel much more confident working with memory dumps in real investigations. Great course!

By Neeraj Rawat on 10/12/2024

The course is good to begin with, however it would have been better to cover the setup of volatility on different platforms, instead of directly using a readymade distro. It would have been better to cover a bit of theory about the subject of the course eg: memdump. mem.raw, hiberfil etc The author could have also shown the live memory capture instead of pointing to another course that hasn't been updates since 2015. Overall it's a good course to begin with and then explore more based on the " The Art o Memory Forensics " book. It will be great to introduce more detailed courses for intermediate and advanced level before anyone else does to be the Best selling author in this field.

By Alessandro P on 9/20/2022

Excellent explanation on how to look for malware using volatility and "manual" analisys. The only thing, the title is a little misleading since the course is about finding malware and nothing else. Maybe "Memory Forensic for Malware" would have been more appropriate.

By TOH KOK SIN on 7/31/2021

This course provide a quick jumpstart into memory forensics using the Volatility, an opensource tool for memory forensics. Trainer provide clear information using practical lab to demonstrate the usage.

By Veronica Zvereva on 10/20/2020

Thank you, Michael, for this amazing series! It was one of my first courses taken on Udemy and it's definitely the best. Material is presented in a clear and digested way so that no questions are left unclear and unanswered. Unlike some of the courses here, this one is getting updated from time to time. One of the most useful investments on online courses :-)

By Clinton Maxwell on 6/30/2019

Great for vol.py beginners. I've taken SANS courses, but this content breaks down the topics and can be easily understood. The narrator has a great voice and consistent communication style.

By Lautaro Barrera on 6/14/2019

This is an excellent course, although too elemental.For someone that have no or little acquaintance with volatility, this course would be a very good starting point. The course is well done and structured and the speaker has a very clear and intelligible voice (which is not always the case in Udemy courses.

By Sylvain Desharnais on 3/1/2016

Knowledge neetly assembled. Speaker speaks clearly and pacely so its easy to hear (even for my French speaking ear) and understand. Mouse pointers are highlighted so it's easy to follow. Excellent job!

By Daniel Arrugueta on 1/20/2016

This class provides a good first step into memory forensics. By itemizing processes found in memory and their characteristics and rules, the class establishes a clear methodology for conducting the initial steps in a memory analysis.

By Todd Rostalski on 9/23/2015

Definitely a great intro "triage" course to get you to see some really obvious things quickly. I liked how the individual processes were broken up as this helped for quiz time. A couple of the transitions could be edited a little better and the music intro could be shorter on these bits. For someone who has never done this type of thing, this is great!

Showing all 10 reviews on CourseDuck

Read all 607 reviews on Udemy

icon
Quality Score

No CourseDuck member has rated this course yet. Taken it? Give each part a thumbs up or down.

Content Quality
/
Video Quality
/
Qualified Instructor
/
Course Pace
/
Course Depth & Coverage
/

Overall Score : 92 / 100