Skip to main content
CPEBuddy
Extracting the unseen: Real-world RAM acquisition and analysis from Android devices

Extracting the unseen: Real-world RAM acquisition and analysis from Android devices

Source: YouTube · SANS Digital Forensics and Incident Response · published Dec 16, 2025 · 31:18

Cybersecurity
No ratings yet Log in to rate
Transcript Available
Description

Alex Collie presents techniques for extracting and analyzing Android RAM, demonstrating how volatile memory can yield crucial evidence like Wi-Fi connection timestamps to place suspects at crime scenes 0:07-0:13.

Key Takeaways:
• Collie leverages nearly 35 years of law enforcement experience to challenge assumptions about RAM volatility and mobile forensics 0:07-0:13
• His investigative background informs research showing Android RAM retains data far longer than commonly believed 0:34-0:42
• RAM extraction techniques offer value across law enforcement, defense, and enterprise incident response 0:44-0:53

By extracting Wi-Fi MAC addresses with timestamps from RAM, investigators can build detailed location histories that traditional forensic methods miss, transforming volatile memory into actionable evidence.

Sources:

  • 0:07-0:13 Introduction of Alex Collie and his 35 years in law enforcement
  • 0:34-0:42 Mention of his extensive case and investigation experience
  • 0:44-0:53 Description of the diverse audience composition

Generate CPE Credits

Generate a professional CPE document from this video's transcript.

Estimated credit: 0.5 CPE hours

Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.

Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.

CISSP Domain Mapping
Learning Objectives
Self-Assessment Questions
PDF Export Ready

Free account. One generation at a time, with a daily limit.

CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.

Watch on YouTube

Transcript Preview

First 800 characters of the transcript

The next uh talk is going to be I'm privileged to have Alex Collie. We are privileged to have Alex Collie with us today. He's been with law enforcement for almost 35 years. Okay, that's a long long time helping the community. So, thank you for that. and uh he has been uh well he's going to be talking to us about a number of uh well a very cool research he has been doing and and a lot of his experience can in uh in some u in some of the work he has done. I wanted to talk to him first um because you have uh well with such such long experience and I know you've been um involved in so many cases and so many investigations. He was asking me like well we have a very diverse community here today and we all uh we have law enforcement we have defense we have uh defenders for the enterprise. So I th…