Flash and Memory Forensics course provides the student with the critical skills necessary to conduct flash and other memory forensics investigations. In today’s world, the necessity to understand flash and other types of memory used in computing is as necessary as it is to understand other major components of the computer forensics field. With a growing usage of flash memory devices, such as thumbdrives, solid state disks, hybrid disks, and other volatile memory systems on smartphones, tablets, laptop computers, desktop computers, and servers, it is paramount to have a solid understanding of how to implement forensics in a manner that alleviates the likelihood of losing volatile memory. The student will learn proper techniques to capture flash and other types of volatile memory, develop a solid understanding of the tools and techniques to conduct live systems analysis of volatile memory and other memory analysis using high-low-level analysis, process timelining, and Virtual Address Descriptors Tree to identify anomalous behavioral patterns. The student will learn the best practices of flash and memory forensics, to include alternative acquisition techniques, and learn how to document their forensics analysis of the memory they are analyzing. And finally, the student will learn how to detect hidden processes, dynamic link libraries hijacking, kernel level rootkits, and other types of incidents using the tools and techniques learned in this course.