Hands on Digital Forensics
What will you learn?
On completion of this one day course, delegates will be able to:
- Understand what is meant by the term digital evidence.
- Describe the reasons why digital evidence may be required.
- Identify the current risks of cyber crime activity.
- Describe the different stages of the incident response lifecycle.
- Apply knowledge of local organisational considerations to plan how incident response would impact operations at an organisation.
- Apply knowledge of digital data acquisition and preservation theory to define a set of procedures.
- Describe hardware which can assist with digital data acquisition. Apply knowledge of digital data acquisition software throughout the course.
- Describe stages of preparation required for digital data acquisition and preservation. Understand the various imaging offerings available and the benefits of each.
- Identify key elements of digital data through basic searches.
- Describe what information can be obtained through code analysis. Apply knowledge of reporting digital forensic discoveries when required.
- Describe why mobile device forensics is important. Identify different methods of obtaining data from mobile devices.
- Apply knowledge of mobile forensics to obtain data from an Apple iPod Touch. Describe multiple methods of forensic circumvention.
- Apply knowledge of future issues to ensure your organisation is prepared.
Course Overview
This course introduces the topic of Digital Forensics and the use of this technology within the IT industry. It provides an overview of digital forensics, evidence and computer crime. An introduction to incident response is given followed by the practical acquisition and preservation of digital data. Once the digital data has been acquired, the analysis of the data is performed before looking at mobile devices and into the future plus forensic circumvention methods. The practical focus of this course is the use of open source tools which can be used in a number of scenarios to assist with the networking and security work undertaken by members of the JANET(UK) community.
Topics Covered
- What is digital evidence: Requirements for digital evidence and Cyber Crime.
- Incident Response: Lifecycle and Organisational considerations.
- Acquisition and preservation of digital data: Theory, Hardware, Software, Preparation and Imaging.
- Analysis of digital data: Basic Searches, Code Analysis and Reporting.
- Mobile Devices: Basic Operations, Forensics and extracting data from a mobile device.
- Forensic circumvention and future developments.
Who should attend?
This course will be relevant to those who are incident investigators; this is likely to be those in network management/engineer positions, those in security related position as well as server and infrastructure staff.
Timetable/On the Day
The course timetable will be adjusted on the day to allow discussion of areas of particular interest to the audience. The course will therefore run from 10am to 4.30pm . Registration will take place from 09:30 – 10:00.
All our courses are designed to provide a balance between practical activities and information dissemination, as we believe people learn when they are engaged within the instructional process. This course includes participant involvement through hands-on activities, discussion, group work and simulations created specifically for the course. All delegates will receive a workbook specifically written for the course and online course support areas.
Lunch and refreshments will be provided.
Related Courses
