Computer forensics as an IT asset

Participants will learn basic concepts of computer forensics and the tools used for this purpose. Digital evidence and how to collect it, either for internal investigation or to be used in the legal proceedings will be covered in this module.

In this module, data storage connector types and data storage types in general (HDD, SSD, optical media) will be reviewed.

Participants will learn about mostly used filesystems like FAT32, NTFS and EXT4. Data recovery will be discussed and during the hand-on exercise, participants will recover deleted data by using standard undelete methods and by using file carving methods. It is recommended to bring used USB key to the class, so that one can try to identify which of the deleted files and folders are recoverable.

With more advanced and smarter malware, it’s becoming more and more difficult to identify how those programs infected the machine. Usually, the only trace they leave is waiting in the memory to be found. Delegates will have a chance to analyze the memory image of infected machine to answer the questions like when, how and through what infection path(s) the machine was compromised.

One of the mostly used ways of hiding data from other users is steganography, process of hiding data inside another data. In this module participants will learn about different ways the steganography could be used in digital world, and how to hide the data inside another data.

Almost each internal forensic analysis must deal with network log analysis. One of the mostly used free network analysis tools is Wireshark. In addition to Wireshark, Network miner tool will be covered too. Each of those tools has different usage during the network forensic investigation – it will be demonstrated live during this session.

Microsoft Encrypted File System (EFS) is a building block of NTFS file system, available since Windows 2000. This is file level encryption that uses PKI architecture to be as robust and tamper resistance, as possible. During forensic analysis, experts often have to decrypt various types of files including EFS encrypted files. In this module participants will learn about EFS inner workings, PKI architecture and how to break EFS encryption. BitLocker is Windows built-in full disk encryption technology. It is safe and robust if used properly. Unfortunately, default BitLocker installations are susceptible to hacking and simple decryption, which will be demonstrated in this module.

In this module, participants will have the opportunity to test their skills through the forensics challenges that will help them to further strengthen the newly acquired knowledge from different fields like, steganography detection, EFS decryption, network logs analysis and various tools used during the training.

• Polaznicima pripada sertifikat o pohađanju kursa Computer forensics as an IT asset za ostvarenih minimalno 70% prisustva od ukupnog fonda časova