To address the evolution of technology, a new course on “Memory Forensics” will be developed, with contributions from LEA and academic experts. The analysis of volatile memory, which contains many pieces of information relevant to forensic investigations (cryptographic secrets, deleted files, running processes, etc), is paramount for digital forensics and investigating cybercrime cases.
The content will include Windows and Linux internals, memory layout, acquisition, analysis and interpretation in the Law Enforcement context, with a focus on maintaining the chain of custody. Software and hardware tools and techniques will also be considered key components of the practical side of the training.
The course development will take place during 2025-2026. As with all ECTEG materials, the new course will be made available free of cost to all MS LEAs, CEPOL, Europol, and the Council of Europe.
Project partners and contributors
ECTEG, Hessen State Police Academy (Germany), Belgian Federal Police (Belgium), Polish Police Cybercrime Bureau (Poland), University College Dublin CCI (Ireland).