Course Outline:
Module 1: Introduction to Computer Forensics
- Topics Covered:
- Fundamentals of Computer Forensics
- Types of Cybercrimes and Digital Evidence
- Forensic Investigation Process and Methodology
- Legal Considerations in Forensics
- Chain of Custody and Evidence Handling
- Hands-On Labs:
- Setting up a forensic workstation
- Practicing chain of custody and evidence handling
Module 2: Evidence Acquisition and Preservation
- Topics Covered:
- Importance of Evidence Preservation
- Imaging Techniques and Tools (e.g., FTK Imager, EnCase)
- Creating Forensic Copies (Bit-by-Bit Imaging)
- Evidence Integrity and Verification (Hashing)
- Live vs. Dead Acquisition
- Hands-On Labs:
- Creating forensic images of hard drives
- Verifying images with hashing algorithms
- Live data acquisition from a running system
Module 3: File Systems and Data Recovery
- Topics Covered:
- Overview of File Systems (FAT, NTFS, EXT, HFS+)
- Understanding File Structures and Metadata
- Data Recovery Techniques
- Deleted File Recovery and Carving
- Hidden and Encrypted Data
- Hands-On Labs:
- Analyzing file structures in NTFS and EXT
- Recovering deleted files using forensic tools
- Data carving techniques to extract hidden files
Module 4: Windows Forensics
- Topics Covered:
- Registry Analysis and Artifact Extraction
- Windows Event Logs and System Files
- Forensic Analysis of Windows Artifacts (prefetch, recycle bin, etc.)
- Analyzing User Activity (recent files, browser history)
- Memory Forensics in Windows
- Hands-On Labs:
- Registry analysis for user activity tracking
- Analyzing Windows event logs
- Memory analysis to detect malicious activity
Module 5: Linux and MacOS Forensics
- Topics Covered:
- Basics of Linux and MacOS File Systems
- Log File Analysis in Linux and MacOS
- User and System Activity Tracing
- Analyzing Linux Partitions and Artifacts
- Data Recovery and Forensics Tools for Linux and MacOS
- Hands-On Labs:
- Analyzing log files and shell history in Linux
- Investigating user activities and file access
- Data recovery from Linux and MacOS systems
Module 6: Network Forensics
- Topics Covered:
- Fundamentals of Network Forensics
- Capturing and Analyzing Network Traffic
- Intrusion Detection and Incident Response
- Tools for Network Forensics (Wireshark, Tcpdump)
- Analyzing Packet Captures (PCAP files) for Forensics
- Hands-On Labs:
- Capturing network traffic with Wireshark
- Analyzing packet captures for signs of intrusion
- Identifying malicious activities in PCAP files
Module 7: Mobile Device Forensics
- Topics Covered:
- Overview of Mobile Operating Systems (iOS, Android)
- Mobile Forensics Tools and Techniques
- Data Acquisition from Mobile Devices
- Analysis of Call Logs, Messages, and App Data
- Challenges in Mobile Forensics (encryption, cloud backups)
- Hands-On Labs:
- Acquiring data from mobile devices
- Analyzing call logs and messages on Android
- Extracting app data for forensic analysis
Module 8: Forensic Reporting and Documentation
- Topics Covered:
- Documenting Findings and Analysis
- Writing Forensic Reports for Legal Proceedings
- Presentation of Forensic Evidence
- Best Practices in Reporting and Evidence Storage
- Testifying as a Forensic Expert
- Hands-On Labs:
- Preparing forensic reports using templates
- Documenting findings with screenshots and summaries
- Role-playing expert witness testimony for court preparation
Structured Labs and Case Studies
- Structured Labs:
- Lab: Imaging and verifying a hard drive
- Lab: File recovery and data carving
- Lab: Registry analysis and event log analysis
- Lab: Network traffic capture and analysis
- Lab: Mobile device data acquisition
- Lab: Forensic report generation
- Case Studies:
- Real-world forensic investigation scenarios for hands-on practice
- Analyzing and reporting on simulated cyber incidents
Training material provided: Yes (Digital format)
