Learning Cyber Incident Response and Digital Forensics

Learning Cyber Incident Response and Digital Forensics

• Overview
• Getting started

1. Fundamentals of Digital Forensics

• Digital forensics
• What is cybercrime?
• Digital forensics investigations
• Types of evidence
• Best practices
• Review of the chapter quiz

2. Selecting Forensic Tools

• Selecting forensic tools
• Types of forensic tools
• Commercial vs. open-source forensic tools
• Legal considerations
• Building a forensic toolkit
• Review of the chapter quiz

3. Digital Forensic Investigation

• Digital forensic investigation
• Preserving evidence
• Preparing an evidence drive
• Creating a trusted tools USB drive
• Collecting volatile evidence
• Collecting network evidence
• Imaging storage devices with FTK
• Imaging a USB drive with DD
• Review of the chapter quiz

4. Conducting Forensic Analysis

• Conducting forensic analysis
• Analyzing memory contents
• Importing evidence into Autopsy
• Analyzing hidden and deleted files
• Analyzing the windows registry
• Conducting log analysis
• Creating your report
• Other considerations
• Review of the chapter quiz

5. Cyber Incident Response

• Cyber incident response
• Preparation phase
• Detection and analysis phase
• Containment, eradication, and recovery phase
• Post-incident activity phase
• Review of the chapter quiz

6. Conducting a Cyber Incident Response

• Conducting a cyber incident response
• Static analysis with floss
• Dynamic analysis with Autoruns
• Investigating the scheduled task
• Packet analysis with Wireshark and process monitoring
• Files and folders created
• Static analysis with IDA and OllyDbg
• Static analysis with process dump
• Malware IoC research
• Review of the chapter quiz

Conclusion

• What to do next