Duration
3 days
Overview
Digital forensics and incident response are two of the most critical fields in all of information security. The staggering number of reported breaches in the last year has shown that the ability to rapidly respond to attacks is a vital capability for all organizations. Unfortunately, the standard IT staff member is simply unable to effectively respond to security incidents. Successful handling of these situations requires specific training in a number of very technical areas including filesystem implementation, operating system design, and knowledge of possible network and host attack vectors. During this training, students will learn both the theory around digital forensics and incident response as well as gain valuable hands-on experience with the same types of evidence and situations they will see in real-world investigations. The class is structured so that a specific analysis technique is discussed and then the students immediately analyze staged evidence using their newly gained knowledge. Not only does this approach reinforce the material learned, but it also gives the investigator a number of new skills as the course proceeds. Upon completion of the training, students will be able to effectively preserve and analyze a large number of digital evidence sources, including both on-disk and in-memory data. These skills will be immediately usable in a number of investigative scenarios, and will greatly enhance even experienced investigators' skillset. Students will also leave with media that contains all the tools and resources used throughout the training.
Day 1
- Overview, high level discussion of forensics capabilities
- Overview of Disks and Storage Mediums
- Forensics Imaging
- Filesystem theory (FAT & NTFS)
- The Sleuthkit
- File Carving
- Browser Activity Analysis
- Recycle Bin Analysis
- LNK File & Jump List Analysis
Day 2
- Application Analysis
- Windows Cache Analysis
- Windows Registry Analysis
- System Restore Point and Volume Shadow Service
- Event Log Forensics
- Office Metadata Examination
- Picture Forensics
Day 3
- Outlook/PST Analysis
- Exchange Forensics
- IIS Forensics Analysis
- MSSQL Forensics Analysis
- Time lining
- Detecting and Handling Anti-Forensics
- Overview of Memory Forensics
- Windows Memory Acquisition Techniques
- Windows Memory Analysis with Volatility
- Final Investigation
- Wrap up and Conclusion
Programme scope, delivery arrangements and suitability are confirmed during enquiry.