Digital Forensics and System Hardening For Beginners

Loading the disk from a compromised machine, this lecture guides creating a new case, selecting a local disk data source, and processing it with the autopsy forensic browser.

Use autopsy to analyze common compromise artifacts on a windows client, inspecting event and security logs, registry files, suspicious tasks, and malware indicators like password hashes and VirusTotal findings.

Export the registry with Windows Registry Recovery to identify authentic versus hacker-created administrator accounts (CID 500, 1003, 501) and inspect startup, services, and network configuration for compromised VMs by IP.

Master Linux forensics by imaging a compromised Linux machine with FTK Imager, examining it with Autopsy, and analyzing common locations of compromised artifacts.

Learn to create a Linux operating system disk image with FTK Imager by exporting a physical drive as a raw image to a desktop folder.

Load a disk image from a compromised machine into autopsy, create a new case, and begin data analysis. Note ntfs, fat, and Linux ext3/ext4 file systems encountered.

Analyze common locations of compromised artifacts on a Linux image, using auth.log, history, and web root logs to reveal brute-force login attempts, new user creation, and data exfiltration.

Examine how browsers track visited websites and how history serves as evidence in court. Understand incognito mode avoids history in browsers like Chrome and Firefox.

Examine Google Chrome artifacts for forensics by inspecting SQLite databases that store history, cookies, and search terms with an SQLite browser.

Learn how to analyze Mozilla Firefox data stored in SQLite databases, locate history and cookies using the browser's SQLite manager, and extract visited sites and complete URL paths.

Learn to perform forensic investigation for Windows servers using Autopsy to examine registry files, scheduled tasks, and file timestamps, and analyze IIS logs for insights into network operations.

Export the registry with the Windows Registry Recovery Tool, examine sam and groups to identify administrator (500) and guest (501) Ssids, and analyze startup applications with autopsy.

Hardening Windows Server by removing vulnerable roles, disabling the guest and suspicious accounts, and enforcing encrypted protocols to prevent anonymous access and uncredentialed enumeration.

Secure Linux by applying best practices to protect company servers and cloud environments, using Kali Linux and Ubuntu as attacker and target to exploit and then secure the system.

Explore five essential terms in digital forensics and system hardening: Kali Linux, Anonymous FTP, Apache, Nmap, and UID of zero for root access.

Explore network scanning and OS detection to reveal open ftp, ssh, and smb services, understand password exposure via shadow and root access risks through credential cracking.

disable the root account and remove insecure services on ubuntu, run an nmap scan, remove ftp telnet apache, and secure samba by disabling anonymous access while keeping ssh.

Learn to install Windows 10 in VirtualBox by downloading VirtualBox, obtaining Windows 10 ISO, creating a VM with 50 GB disk and 4 GB RAM, and running Windows 10.

Install kali linux in virtualbox using either a preconfigured virtual machine or a manual iso installation, and explore kali's use for penetration testing and ethical hacking.

Demonstrates a brute-force attack on Windows 7 to recover the original password with Cain and Abel, and notes it works on XP through 8, not 8.1 or 10.

Use Lasersoft to recover Windows data when methods fail, creating an ISO and bootable media to access target system, then copy data to an external drive or reset password.

Explore the five hacking steps: footprinting to gather information, scanning for weaknesses, gaining access via vulnerabilities, maintaining access with backdoors, and clearing tracks to remove evidence.

Learn about internet anonymity and privacy, including why you can never be 100% untraceable, and explore tools like Tor, VPNs, proxies, and IP address changers.

Explore how proxy servers create a fake identity, bypass firewalls, and access blocked websites via a proxy chain, illustrated with a practical example.

Learn to set up and use anon surf proxy on Kali, clone from GitHub, install with installer.sh, and manage with start, stop, restart, and IP checks.

Explore how vpn uses encryption to create a secure tunnel in a virtual private network, distinguishing it from a proxy.

Set up a free openvpn connection using vpnbook on kali linux, using port 443 over tcp to establish a secure, encrypted tunnel.

Explore cyber forensics as the science of collecting digital evidence across devices and deleted data, and examine phishing, malware, identity theft, data wiping, encryption, and steganography.

Explore the three main types of digital forensics investigations: criminal, civil, and administrative, and see how money frauds, threatening messages, land disputes, and government fraud cases fit each category.

Learn about volatile and non-volatile evidences, with examples such as system time, open files, process information, clipboard, network information, command history, hidden files, and event logs.

Identify the five investigation phase steps: warrant or consent letter, first responder, photograph and document evidences, collect evidences, and analyze evidences.

Learn what a virtual machine is. Create a software computer inside Windows 11 and install an operating system using VMware Workstation Player for safe practice.

Create a virtual machine using an installer disk, installer disk image file (ISO), or install later, then choose the operating system and allocate 2 gb RAM and 60 gb disk.

Upgrade to VMware workstation 17 player, create a new virtual machine, and install Windows 10 64-bit with 2 GB RAM, configuring settings and network for a ready VM.

Explore virtualization by running Windows 7 inside Oracle VirtualBox alongside Windows 11, creating isolated systems where the guest's actions cannot harm the host.

Compare NAT network and bridged mode in virtualization tools like VMware Workstation or VirtualBox, with a router and multiple systems, and learn how to add a hard disk.

Navigate to Oracle Live SQL, create an account with your email address and password, sign in, and open a new worksheet to begin coding.

Practice queries in the sql worksheet, switch to the HR schema to view employees, and save the session as a script to recreate work later.

Learn how to practice SQL using the Oracle database, with context on other databases like Postgres. Explore database mode, the logical view, and the core database objects.

Describe three database modes: open mode for read/write access, mount mode for DBAs upgrades or migrations, and inactive mode for preparation, with a raw material to finished product analogy.

Explore how a database's logical view organizes data into table spaces, segments, and blocks, and how a server hosts multiple databases.

Explore the database object list, where tables store data in a table format and views act as virtual tables that present data from multiple tables in a single output.

Explore how functions serve as the smallest logical unit for performing actions, and why database indexes optimize data retrieval across thousands of columns for fast access.

Explore sequences as the automatic numbering system that assigns numbers across lines, preventing gaps, and examine materialized views that store query outputs alongside tables and views inside the database.

Explore triggers as actions based on events, from smartphone notifications to updating outputs in related tables, and learn how changes in column one propagate to column seven.

Explore stored procedures and packages, contrasting them with functions, and learn how procedures follow a process to produce specific outputs, with packages grouping multiple procedures.

Data types act as restrictions that organize table columns, ensuring reliable queries, and introduce a list including character, integer, decimal, date, and timestamp.

Explain how integers represent whole numbers, while decimals use precision and scale (p, s), and contrast decimal with fixed scale to numbers with fixed precision and scale.

Define date and timestamp data types, showing that date stores only day, month, and year, while timestamp records date and time down to milliseconds for column definitions.

Explore how data types and data constants validate column values, and master data constraints including primary key, foreign key, unique key, not null, and check in database design.

Learn how a primary key uses a single column to uniquely identify records and prevent duplicates. Disallow nulls and enable auto indexing for fast data retrieval.

Discover how a unique key can span multiple columns, allows null values, prevents duplicates, and enables auto indexing in a table, unlike a primary key.

Understand what a foreign key is and how it references a primary key in another table, with multiple columns as foreign keys and duplicates and null values permitted.

Declare multiple columns as not null to disallow blank values while allowing duplicates. Website forms use asterisks to mark required fields, illustrating not null data entry in practice.

Apply check constraints to any column to enforce a specific condition, such as the salary column with a value greater than 10,000, ensuring input meets restrictions.

Study sql data definition language and its five statements—create, alter, drop, truncate, rename—and how they define and modify database objects such as tables, views, and triggers.

Explore data manipulation language (DML) to manipulate database data, mastering insert, update, and delete operations for rows and records, and understand truncate to empty a complete table.

Explain how transaction control language (TCL) manages database queries and data changes, and outline the three TCL statements: commit, rollback, and savepoint.

Learn how data retrieval language, DRL, the final SQL category, retrieves data from the database using the select statement to view results.

Explore ddl statements with a focus on the create statement, including creating a table named exam_one with columns exam_code and exam_type using varchar(10), and handling existing objects.

Create tables by defining columns and data types, then apply constraints—primary keys, not null, unique, and foreign keys—and enforce checks to keep exam marks under 100.

Chapter 30 shows naming constraints in create statements, applying primary key, not null, reference, unique, and check keywords. It walks through creating exam_three with named constraints and validating the run.

Naming constraints improve readability and recall, avoiding hard-to-remember alphanumeric codes. Use descriptive names like exam_domain or x_pk to identify columns and constraints, and quickly open tables by searching.

Demonstrate creating a backup table with create table new_table as select * from existing_table, copying all columns and rows. Learn how to drop the backup if needed.

Explore the alter statement, the next ddl after create, and its six core functions: add, modify, enable, disable, drop, and rename, to modify database structures.

Learn how to alter a table to add columns and constraints, including primary keys, check and not null constraints, and foreign keys, with example steps using exam_one and exam_code.

Learn how to rename a column in a database table using alter table rename column, changing XM type to exam type in the exam one table, with the required semicolon.