Digital Forensics

Day 1: Disk Forensics

This session gives an overview of the history of disk forensics. Basics such as file structures, metadata, file systems concepts, windows file systems and disk partitioning are covered leading to a practical investigative scenario.

Topics

File system features, FAT, exFAT, NTFS, File slack, Volume shadow copies, Master boot record partition table, GUID partition table, Partition slack.

Day 2: Registry Forensics

This session focuses on the analysis of low level configuration settings located within the Microsoft Windows registry. You'll gain an understanding of the Windows registry as a hierarchical database which will culminate in a practical exercise of detecting malware within the registry utilising Python.

Topics

Configuration analysis, Registry keys and values, Registry root keys, Hives, Deleted registry keys.

Day 3: Network Forensics

This session looks at how network investigations deal with volatile and dynamic information, focusing on the analysis and monitoring of computer network traffic for the purposes of information gathering, legal evidence and intrusion detection.

Topics

The internet protocol, Packet structures, Addressing methods, Application layer protocols, Netflow.

Day 4: Memory Forensics

This session covers the history of memory forensics and modern computer architecture. We'll then cover several memory management techniques and look at how these can be leveraged in forensic processes.

Topics

Process concept, Memory layout, Process management, Windows environment block, Thread concept, Thread management, Virtual memory, Page concept, Memory protections, Virtual Address Descriptor (VAD), Kernel interface, Hibernation.

Day 5: The Forensic Method

This session covers various digital forensic analysis techniques from multiple viewpoints in order to derive meaning and intelligence from gathered evidence. We'll look at what it's like to be in an offensive position and how this can provide analysts with a significant tactical advantage.

Topics

Locard’s Exchange Principle, Offensive Operations, Forensic Investigation Requirements, Digital Forensic Life Cycle.

Please download the Digital Forensics course PDF.