Doing memory dump analysis training for several years we found that students are divided into 2 types: those who prefer to see source code first and those who want to see a memory dump first. We actually prefer to show a memory dump first and then explore it to find certain patterns of abnormal structure and behavior. Software Diagnostics Services136 used this approach to design its Accelerated Windows Memory Dump Analysis137 and Accelerated .NET Memory Dump Analysis138 courses. Students explore memory dumps and debugger logs to find memory dump analysis patterns which are introduced when necessary. After that they can check source code of modeling applications if they have development experience. Accelerated Windows Software Trace Analysis139 course uses a different approach. It introduces all software trace analysis patterns at once because they are patterns from software narratology140 independent from programming languages and software platforms. After that they explore and analyze software traces and logs. We can summarize these 2 approaches on this diagram:
136 http://www.patterndiagnostics.com/
137 http://www.patterndiagnostics.com/accelerated-windows-memory-dump-analysis
138 http://www.patterndiagnostics.com/accelerated-net-memory-dump-analysis
139 http://www.patterndiagnostics.com/accelerated-software-trace-analysis
140 http://www.patterndiagnostics.com/Introduction-Software-Narratology-materials