Visão Geral

O curso Digital Forensics fornece uma introdução básica sólida à Digital Forensics em sistemas baseados em Microsoft Windows. Você trabalha em um ambiente Windows e Linux para suas estações de trabalho investigativas e é exposto a habilidades teóricas e práticas para um examinador forense de nível básico (aquisição, análise e relatórios), com exposição a tópicos avançados (sistema ao vivo e análise forense móvel).

Objetivo

Após concluir este Curso Digital Forensics, você será capaz de:

• Desempenhar as funções essenciais de um examinador forense
• Preparar e executar investigações forenses digitais em sistemas baseados em Windows
• Aplicar metodologias forenses para preservar, adquirir, extrair e analisar informações de importância investigativa
• Identifique e analise os principais artefatos do Windows de importância investigativa

Materiais

Conteúdo Programatico

Defining digital forensics

1. Articulating the importance of Locard's Principle
2. Contextualizing digital forensics within incident response

Explaining the role of digital forensics in investigations

1. Criminal, civil and intelligence/anti-terrorism investigations
2. Applying the scientific method to investigations

Articulating the role of a digital forensic examiner

1. Maintaining objectivity within investigations
2. Ensuring confidentiality and integrity

Exploring legal considerations of digital forensics

1. Respecting privacy rights and expectations
2. Addressing and reporting illegal information

Defining and applying privacy principles

1. Outlining the twelve privacy principles
2. Addressing the duty to preserve in eDiscovery

Examining the core operational principles of a computer

1. Inspecting hard drive storage and architecture
2. Reviewing the operations of computer memory

Identifying multiple locations of digital evidence within a computer system

1. Investigating alternate data streams
2. Uncovering hidden data with Steganography

Determining lab requirements

1. Key components of a digital forensics lab
2. Conducting tool validation

Preparing and configuring a forensic workstation

1. Demonstrating appropriate use of a hardware write-blocker
2. Exploring key features of commercial and open source forensic software (e.g., EnCase, FTK, DD)

Image acquisition

1. Creating bit-for-bit copies of digital evidence
2. Mounting and searching images

Documenting the physical and digital crime scene

1. Conducting crime scene photography
2. Executing triage techniques and methodologies

Managing the chain of custody

1. Bagging and tagging physical evidence
2. Documenting and demonstrating evidence continuity

Identifying key Windows artifacts

1. Recovering and searching the Windows registry
2. Hibernation files, event logs, prefetch, shellbag and lnk files
3. Password hash extraction and cracking

Performing keyword searching, bookmarking and timeline analysis

1. Developing strategies for effective keyword searching
2. Reconstructing the order of events with timeline analysis

Conducting e-mail, web browser and USB investigations

1. Extracting and recovering deleted data from slack space
2. Tracking user activity and addressing Trojan Defense
3. Performing Mobile Forensics

Safely handling mobile devices during investigations

1. Examining the use of Faraday bags
2. Demonstrating the use of mobile cables and write-blockers

Preserving and acquiring evidence from mobile devices

1. Investigating evidence located within the address book, calendar, mail, apps and SMS
2. Recovering data from SIM cards

Performing live memory acquisitions

1. Demonstrating the investigative value of live memory analysis on running systems
2. Utilizing open-source tools to capture and extract live memory

Analyzing memory dumps for investigative information

1. Determining running processes, active network connections and recent commands
2. Identifying hidden processes and Malware