Learning Computer Forensics

Introduction

• Computer forensics
• What you should know

1. Understanding Computer Forensics

• Definition and goals of computer forensics
• History
• Types of investigations
• Tools
• Legal implications
• Current and future trends
• Challenges
• Anti-forensics techniques
• Compliance and forensics
• Cybersecurity and forensics

2. Areas of Computer Forensics

• Specializations in computer forensics
• Network forensics
• Operating system forensics
• Web forensics
• Cloud forensics
• Malware forensics
• Mobile forensics
• Email forensics
• Certifications

3. Preparing for an Investigation

• Tools and knowledge requirements
• Hardware
• Software
• Understanding hexadecimal numbers
• Using a hex editor
• Understanding offset
• Forensics OS distributions
• Challenge: Hex editor
• Solution: Hex editor

4. File System Fundamentals

• Understanding file systems
• Understanding the boot sequence
• Understanding disk/solid-state drives
• Understanding the master boot records (MBR)
• Understanding Partitioning
• Challenge: Partitioning a USB drive
• Solution: Partitioning a USB drive

5. Persisting Data

• Evidence preservation approaches
• Understanding the role of write blockers
• Using a software write blocker
• Using hardware write blockers
• Understanding hashing
• Hashing algorithms
• Case Study: Hashing in FTK Imager
• Understanding mounting
• Mounting manually
• Challenge: Hashing in Kali
• Solution: Hashing in Kali

6. Aquiring Data

• Data acquisition approaches
• Static acquisition with open-source tools
• Static acquisition case study with dd
• Static acquisition case study with dcfldd
• Live acquisition case study with a commercial tool
• Challenge: Live acquisition with a memory dump file
• Solution: Live acquisition with a memory dump file

7. Putting It All Together: Analyzing Data and Generating Reports

• Forensic data analysis
• Indexing
• Searching
• Generating a Report
• Case Study: Hex editor analysis of a file with a wrong extension
• Hex editor analysis of a bit-shifted file
• Case Study: Steganography

Conclusion

• Next steps