Memory Analysis

Our students are as passionate about learning as we are about teaching. At the end of a satisfying course, they're always glad to share some thoughts. Here are a few remarks from attendees of our training:

 

Online Reviews:

 

• Review - Malware and Memory Forensics with Volatility by Ian Ahl of TekDefense

• Windows Malware and Memory Forensics with Volatility Developers by Alexandre Borges

• Mr Silverlight Drive-by Meet Volatility Timelines by Corey Harrell 

 

Many of our students also tweet their feedback, so follow @volatility to see those responses. 

"
"Great course, I learned a ton and will be making use of what I learned" - Mark N. 

​

"There's no substitute to learning memory forensics from the experts in the field. The labs help to solidify the sometimes abstract/theoretical concepts involved in building concrete knowledge and skills which can readily be applied." - C. L. (Threat Intelligence Analyst). 

​

"Everybody involved in IR or security for that matter needs to know this stuff and I can't imagine it being delivered any better." - Darren F. (Application Security Red Team)

​

"Excellent course that was relevant with the latest real world scenarios." - Asif M. (Senior Investigator)

 

"Take It! After taking over a dozen SANS and other courses, this is one I've taken and been challenged and learned something. " - Adam B. 

 

"I thought I understood Windows internals until I attended this course. Attend if at all possible!" - Troy A. (Malware Analyst) 

 

"Thanks for a great training. Its one of the best (if not the best) I've been to." - Billy M. 

 

"Better than I expected and I knew it would be great" - Ian T. (Security Analyst)

 

"The course is put together in a way that all skill levels and experience will get valuable information." - Jeremy S. (Senior Research Analyst)

 

"TAKE THIS COURSE!!!!" - Dale M. 

 

"It is one of the greatest forensics classes I ever attended." - Ali K. (IT Security Consultant)

"
"Brilliant, fantastic, most technical & deep course. Extremely well delivered" - Eoin C. (Application Security Engineer)

 

"Just take it. Even with several years of experience at a 1st class CIRT, this was an extremely good class and I learned a lot of useful info/tricks to employ in my IR work." - Dan K. 

 

"I am recommending this course to any serious DFIR professional!" - K. Rainey (Security Consultant - IR)

 

"Best class I can remember taking. Should be a required course for any IR support organization" - Jeramy S. (SR Escalation Engineer, Microsoft)

 

"Excellent course, would highly recommend. The instructors are beyond helpful and their knowledge of the content is unbelievable" - Ryan E. (IT Security Engineer)

 

"The knowledge and experience of the instructors is very impressive. The amount of material covered is a lot, but it makes sense and is very relevant to the real world." - A. Bridge (Lead Intrusion Analyst)

 

"An essential training for all security analysts doing digital forensics." - Juan R. (Senior Security Analyst)

 

"Its the best course that I've attended in my life." - Alexandre B. (Instructor) 

 

"Great class! Helpful for taking our team to the next level. Highly recommended!" - Jason M.

 

"DO IT! This has been one of the best trainings I have been to in a while" - Dan J. (Sr. Threat Intelligence Engineer)

 

"In-depth and technical. Great eye-opening course that will definitely help in the scope of future investigation" - T. Q. (Systems Engineer) 

 

"If malware analysis is a major part of your current gig, take this course! The Windows internals knowledge and how to best leverage this data gives you a lot to work with when encountering anti-RE/anti-debugging in various malware samples" - Chris M. (Research Engineer)

 

"One of the single best courses I have ever had" - Joel W. (DFIR Specialist)

 

"I learned more in this class than any other technical course I have taken" - Rich P.

 

"Highest level of knowledge and very well prepared" - Matthew H.

 

"This class is really well thought out. Valuable to any security professional. Read The Art of Memory Forensics and keep the notes so they can be read while taking the class." - Cesar A.

 

"Windows Malware and Memory Forensics by The Volatility Project is easily the most in-depth technical training I've ever attended. I can't recommend this class highly enough for any incident response or forensics professional." - Greg. P (Senior Infosec Engineer)

 

"I've been doing dead box forensics for years. This course was a great compliment to my existing knowledge and really opened my eyes to the value of memory forensics." - John G.

 

"Excellent comprehensive training of memory forensics as it relates to malware and network intrusion investigations. Invaluable tool in an analyst's toolbox." - Carl W. (Senior Specialist)

 

"Hands down the best memory analysis course EVER" - Robert A. (Forensic Analyst)

 

"This course can be used for not only forensics, but threat intel and exploit development" - J.W. (Information Security Engineer)

 

"Excellent hands-on technical course delivered by practicing professionals! Highly recommended to anyone who wants a better understanding of memory forensics" - S.B. (CEO)

 

"Be prepared to have challenging and rewarding material unlike other security courses" - J.G. (Security Consultant)

 

"Absolutely amazing training from the source. Better than SANS memory courses by far!" - J.K. (Cyber Security Researcher)

 

"This class was by far the most in-depth course I have taken. The labs are top notch and will be a valuable source of skill reenforcement in the future. Take this course ASAP!" - Tom N. (Consultant)

"The deepest, most thorough technical course I have ever taken - not only did I learn how to use one of the best memory analysis tools available, I learned an incredible amount of Windows internals. Most important, I understand both enough to extend the functionality to meet any future requirements. Highly recommended - immediately useful and practical information to use in any incident response and malware analysis work!" - James P.

 

"The Volatility course is absolutely excellent and should be taken by any individuals performing IR services and forensics. The course covers  not only the Volatility Framework, but the inner workings of malware and how it interacts with the Windows OS." - Kyle P (Sr. Digital Forensic Examiner)

 

"Amazingly useful information. If you do forensic work, you need to understand and use memory forensics. This course is the best one I've seen so far." - Anonymous

"Excellent course. Instructors are knowledgeable, technical, and present the material very well. This course will expand your skills and help you see all the valuable data that you can gather. One of the best courses I've been to." - Chad W. (SOC Analyst)

 

"Very technical and in-depth course covering windows internals from memory. The best course I've taken so far in my entire career." - Fernando (DFIR/Malware Analyst)

"Be ready to have your mind blown!" - Dion W. (Incident Responder)

 

"Invaluable for law enforcement and cyber crime investigators." - Jon C. (Australian Federal Police)

 

"that was the best training week that I have spent in my entire career" - Sean M. 

 

"The best technical course I have attended" - Sam H., Pen Tester

 

"Best course I've attended in the last ten years" - Andrew K. Technical Investigation Manager 

 

"I've done my share of courses; yours has it all: "wow" factor in class, great expectations, great labs." - Jorge C., IT Security Expert

 

"As relevant (if not more) than any disk based forensics course. Should be required for incident responders / digital forensics investigators" - Christian R., Senior Member of Technical Staff

 

"This course is awesome! I cannot tell you how much I learned" - Mike S., IR Consultant 

 

"Hands down, best technical training I've attended." Harry S., Principal Consultant / DFIR 

 

"Wonderful and mind blowing course" - Lakshmi R., Incident Response 

 

"Not sure anything could make it more valuable" - Anonymous 

 

"Take the course. Don't do the SANS option!" - Shaun B., Forensic Consultant 

 

"A top-notch and highly skilled team presents students with more valuable information and insight than any other source of info - effectively using the premier memory analysis tool" - Matthew G. 

 

"Take it. Just take it. An incredible wealth of info" - Jon P., IR Consultant 

 

"This was a super course, with coherent materials, well structured labs, and packed full of useful and relevant information" - Ross K., Researcher 

 

"If you feel unprepared in responding to intrusions, this class and tool will give you the confidence and understanding you need to make a case." - M. C. (Detective) 

 

"Really enjoyed the technical nature of the course & that you take the time to show how everything works. Not only do I feel much more comfortable with Volatility, but Windows internals too, which is exactly what I was striving for." James N., Forensic Consultant 

 

"The course ties together a lot of things we've seen on disk and shows how the attacker can manipulate this data. Very good stuff." - Shawn L., Forensic Analyst 

 

"Better come prepared to learn." - Corey Harrell

 

"This was the most in-depth forensic course I've ever taken. The instructors are top notch and really know the material and concepts behind it. If you're serious about protecting your network, you need to take this course." - Ryan G.

 

"This is the best forensics training I have ever participated in. You don't just learn what commands to blindly punch in; you gain deep insight into Windows internals, understand how malware can subvert the OS, and how to detect these abuses. Also tons of stuff I can bring home to continue training and apply to my work." - Christian B.

 

"I would like to say thank you for arguably the most challenging and rewarding training I've ever taken." -Benjamin K.

 

"One of the best training courses I've taken. Being instructed by the core developers went way beyond how to use Volatility. They give you a look under the hood so you have an understanding of why and how the plugins work." -Carlos A.

 

"This class has exactly the deep dive into Volatility that I've been chasing after." Jared G.

 

"This was hands down the best (technical, useful, well explained, and relevant to current investigations) DFIR course I have taken in the last 10 years! This is a must take class for anyone in DFIR. Aside from the knowledge and lab experience, the tools provided may be worth the class attendance alone. If you don't take this course, you're doing Windows DFIR wrong!" -Anonymous

 

"An excellent technical malware course, highly recommended!" - Tom 

"I find I have much more ways of success in my work with malware analysis.  Volatility is a great tool, keep up the good work!!!" - Goran 

 "Great contents, expert teachers, hands on examples" - Boudewijn 

 "It was great experience and mind blowing info.  The thing I appreciated the most were the graphics to help with visualisation and putting the Windows internals info in a goal and purpose view." - Anonymous 

"I think this is a really nice course and the best course I have had so far" -  Monnappa 

 

An ultimate course to sharpen your forensic and reverse engineering skills and to get weaponized to track and combat the most sophisticated pieces of malware. - Anthony 

The course was exceptional.  The depth and scope of the research conducted by the trainers was remarkable.  The fact that the trainers were able to provide comprehensive answers to any question posed was refreshing. - Vafa 

This course gave me in depth knowledge of memory forensics and windows malware functioning as a starting point for a whole new level of forensic analysis. - Marco 

The Volatility training was the best memory fundamentals that exists anywhere.  In the labs they go through many memory images with malware I have see(n) in the wild.  Their practical approach to using malware, memory and disk forensics are excellent. - Anonymous 

This course was enriching on so many levels.  Taught by people who know the tool from every angle.  Presenting interesting real life challenges and supporting you whenever you are lost.  Best training I've had in years! - Clement 

 

"One of the best technical classes I've taken in 10 years" - Rich M. 

"Excellent memory forensics training. Definitely would recommend it to anyone in DFIR or malware analysis" - Q.M. 

"Realistic labs and the one-on-one instruction make the entire class worth it. Everything else is icing" - Anonymous 

"Super technical and awesome" - Sarah E. 

"Best forensic and winternal training I've ever experienced. Raises the bar really high" - Lance B.

"This is as valuable an education as any of you have had in your career" - Ash K. 

 

"This course was invaluable for the hands-on experience dissecting real-world malware from memory dumps. Terrific, would absolutely recommend it to anyone in the security field" - Marco C. 

"Huge props to the entire Volatility team for the amazing DFIR work they do and excellent training" - Kyle O.

"The Volatility Team crammed a years worth of answers into one week - they are fantastic" - Tim R. 

"In the past I've avoided forensics because it seemed tedious and slightly boring...this class has completely changed my perspective" - Chris T. 

"I was amazed at the amount of artifacts that could be obtained from memory dumps through the use of the Volatility Framework" - Scott H.  

"The best technical course I've ever attended. Many practical labs, technical info...simply love it" - Salah

"The lab exercises were fantastic; technically challenging and true to life. I really enjoyed the class" - Christopher G.  

"Great, great course. Most malware classes out there walk through analysis of some IRC bot from the 90's and call it good. This was an excellent trip into modern, highly sophisticated malware and gave real methodologies to quickly analyze them" - Brian H. 

"This was the most relevant hands-on DFIR training I've ever had. The topics covered in class are a must for anyone tasked with enterprise security" - William P. 

"Spending a week learning from the Volatility creators is worth every penny. The course is well designed and presented and will help me in my role at work immediately" - Akira M.  

"Mind blowing crash course in Windows internals, malware research, and Volatility packed in just five days" - Marc R.  

"Tons of well presented information on Windows internals and how they relate to memory forensics. Lots of hands-on" - Ron H. 

"Everything you ever wanted to know about Windows memory forensics and beyond. A must take for any incident responder" - Mark P. 

"This is an amazing course that will not only provide the skills and knowledge you need to run Volatility, but also give you a much deeper insight into Windows memory internals" - Dave L.  

"This is much more than a class on how to use a tool. By far the best training I've attended in several years. Instructors are top notch. Excellent class for even the most experienced of analysts" - Adam W.  

"Definitely the most advanced forensics course that one can imagine. I believe that it attempts the impossible - of actually giving a complete overview and state-of-the-art knowledge about memory forensics" - Greg I. 

"Best DFIR course there is" - John P. 

 

The knowledge of the instructors was more than a cut above those at a standard forensics training course." - Anonymous

"This is hands down the most relevant course I have taken in years. I would highly recommend it to any incident responder." - Jack Crook, Information Security Incident Handler

"It is by far the most advanced DFIR course that anyone can take. The course is an amazing value and contains undocumented information on memory analysis." - Wyatt Roersma, Infrastructure Security Engineer 

"Any good memory forensics course is going to teach volatility, so you might as well learn it from the leaders in the field." - Scott Plastine, Incident Response Analyst 

"I went from knowing next to nothing about memory forensics to feeling confident in my ability to identify malware in memory." - Anonymous

"The instructors are highly professional and well versed in memory analysis. This tool beats any other tool in this space." - Byron Thompson