Example embodiments employ a selective memory swapping system for selectively placing non-volatile memory devices of a computer system offline, e.g., for background updating, and online, for use by a computer system, whereby the background updating process includes a mechanism for performing forensics analysis and updating of offline memory devices while an alternate memory device is usable by a user of the first computer system.