Forensic Investigator Fundamentals

Name: Forensic Investigator Fundamentals
Rating: 4.3 (14 reviews)

Computer Forensics

Created byStone River eLearning

Last updated 5/2020

English

English [Auto],

What you'll learn

After successfully completing this course, the students shall be able to:
• Understanding what computer forensics is
• Be able to make a forensics image from a drive
• Be able to mount a drive for analysis
• Understand basic artifacts of the operating system
• Understand basics of first responder to scene and what should be done to secure the digital evidence

Course content

4 sections • 45 lectures • 4h 57m total length

Forensics Introduction - Part 10:19
Respond to a system breach by launching a forensics investigation to understand cyber crimes, computer forensics, what forensics is, why you need it, and the challenges you may face.
Forensics Introduction - Part 234:04
Explore computer forensics foundations: identify incidents, collect and preserve evidence, extract and interpret data, document meticulously, and present forensically sound findings.
Forensics Introduction - Part 30:15
Discover the exciting field of forensics and its challenges, learn that you can perform computer forensics without being an attorney, and see how understanding various laws strengthens your case.
Evidence - Part 10:23
Explore electronic and physical evidence types, learn the best evidence and federal rules of evidence, and understand why and where to collect evidence.
Evidence - Part 224:00
Learn how digital evidence is collected and preserved—volatile and non-volatile data—ensuring authenticity, completeness, reliability, best evidence rule compliance, and admissibility through chain of custody.
Evidence - Part 30:17
Identify what to collect and why in a case, ensuring you collect enough evidence without violating laws of evidence. Learn the correct handling of evidence to support the case.
Forensic Readiness - Part 10:21
Prepare for breaches in your enterprise by implementing forensics readiness and understanding why it matters, then identify qualities of a good investigator and where to seek guidance.
Forensic Readiness - Part 222:19
Forensic readiness enables an organization to maximize digital evidence while minimizing investigation costs by having a plan, in-house procedures, trained personnel, and a robust incident response workflow with law enforcement.
Forensic Readiness - Part 30:20
Adopt a strong code of ethics to build trust and strengthen your case as a trained investigator, and ensure you have resources for forensics readiness in your organization.
Chapter 1 Quiz

Before the Investigation - Part 10:21
Ensure you have a ready team, set up a forensic lab or workstation, and secure a complete investigation toolkit before an investigation begins.
Before the Investigation - Part 218:57
Learn to preassemble an investigation team, secure lab facilities, and build a forensically sound toolkit with workstations, equipment, and procedures to preserve evidence integrity and maintain chain of custody.
Before the Investigation - Part 30:19
Secure a secure area to perform an investigation, provide a good lab area with space and resources, and ensure the workstation has the specs needed for a speedy, thorough investigation.
During the Investigation - Part 10:20
Learn how to seize equipment, collect and secure evidence, and acquire and analyze evidence, with an introductory overview of the investigation steps.
During the Investigation - Part 233:06
Seize and preserve equipment with consent or warrant. Collect and secure evidence, including volatile data, and analyze bit-for-bit copies, maintaining chain of custody.
During the Investigation - Part 30:23
Follow a step-by-step investigation that progresses with each phase, maintain the chain of custody for all evidence, and recognize first responders' responsibilities at the crime scene.
After the Investigation - Part 10:20
Collect documentation to prepare a report for attorneys, business leaders, or law enforcement after the investigation. Assess your readiness to be an expert witness.
After the Investigation - Part 214:50
Wrap up an investigation by gathering documentation and writing a clear, concise report for the intended audience, including relevant findings and evidence.
After the Investigation - Part 30:18
Explore the criteria to become an expert witness and master report writing and documentation, mindful of the audience.
Chapter 2 Quiz

Hard Disks - Part 10:19
Explore hardware basics and learn how to gather evidence from storage devices by examining hard disks, solid-state drives, and hard disk drives.
Hard Disks - Part 223:48
Explore hard disks and file systems, comparing HDD and SSD storage, physical and logical structures, tracks, sectors, clusters, slack space, and RAID configurations for forensic evidence collection.
Hard Disks - Part 30:18
Analyze how hard disks and solid state drives hold evidence and prepare to analyze data, understanding how disks behave and what they are made up of.
File Systems - Part 10:22
Explore how file systems store data on disk and why the logical layout matters for investigations, guiding you to uncover storage information for forensic analysis.
File Systems - Part 223:59
Explore how hard drives are partitioned and organized, including MBR vs GPT, primary/extended/logical partitions, and common Windows, Linux, and macOS file systems used in forensics.
File Systems - Part 30:19
Explore common file systems, their differences across operating systems, and the location of partition types and the master boot record to sharpen forensic investigations.
Booting - Part 10:17
Explore the boot process for Windows, Linux, and Mac OS X and understand how your organization's operating system choice affects startup workflows.
Booting - Part 210:23
Analyze the boot process across Windows, Linux, and Mac to identify how data and evidence emerge during startup, including BIOS/UEFI, MBR, boot managers, and kernel loading.
Booting - Part 30:20
Explore the booting process across Windows, Linux, and Mac to locate hidden data or malware that could hinder investigations, empowering forensic investigators with practical insights.
Chapter 3 Quiz

Data Acquisition - Part 10:20
Prioritize data acquisition by establishing forensically sound data collection procedures, enabling credible findings and court presentation.
Data Acquisition - Part 215:53
Learn how data acquisition creates forensic images from computer media, compare volatile on-site and non-volatile static acquisitions, and uphold the chain of custody while duplicating evidence.
Data Acquisition - Part 30:29
Identify volatile data quickly during acquisition, contrasting with non-volatile data on disks or DVDs after power removal. Choose industry-recognized tools that fit your knowledge base and needs.
Live Acquisition - Part 10:23
Perform on-site live acquisition to capture volatile data before the system powers off, preserving evidence. The lecture covers steps and tips for executing this procedure.
Live Acquisition - Part 218:39
Master live acquisition with proper authorization, careful documentation, and proper logging, then capture volatile data (RAM, caches, routing tables, running processes) before non-volatile evidence.
Live Acquisition - Part 30:22
Master live acquisition techniques by following a data collection order to protect evidence and recover artifacts such as command history, open files, open ports, and clipboard data.
Static Acquisition - Part 10:24
Execute a static acquisition at a possibly powered-down crime scene to reliably capture evidence, and learn the steps to perform it while understanding the difference between copy backups and duplication.
Static Acquisition - Part 215:47
Perform static acquisitions on powered-down systems to capture non-volatile data from disks, SD cards, and USB drives. Use write blockers, sanitize media, verify copies with hashing for forensic soundness.
Static Acquisition - Part 30:20
Learn how to perform a bit-for-bit static acquisition from disk to disk or disk to image, documenting every step and following the prescribed procedures.
Anti-Forensics - Part 10:18
Explore anti-forensics techniques criminals may use to hide actions and evidence, and examine how investigators counter these methods in the developing field of forensics.
Anti-Forensics - Part 211:17
Examine anti-forensics techniques used by criminals to hinder investigations, including encryption, password protection, hidden partitions, rootkits, artifact wiping, and data destruction, and how investigators counter them.
Anti-Forensics - Part 30:16
Develop anti-forensics techniques by thinking like a hacker to stay ahead in investigations and defeat criminals who hide their tracks.
Techniques - Part 10:16
Explore how password protection, root kits, deleted files, and encryption are used to hide criminal activity and learn the techniques needed to detect and defeat them.
Techniques - Part 214:27
Explore password protection and cracking techniques, including dictionary, brute force, and rule-based attacks, and understand hashes, rainbow tables, encryption, and deleted file recovery for investigators.
Techniques - Part 30:20
Criminals use techniques to hide their tracks, so stay vigilant. Defeat them by strengthening password protection, guarding against route kits, deleted files, and encryption.
Countermeasures - Part 10:25
Explore countermeasures for forensic investigations amid data hiding, deletion, encryption, root kits, and damaged systems, and examine how hacking tools help crack passwords, encryption keys, and hidden partitions.
Countermeasures - Part 26:22
Develop countermeasures through training and ethical hacking to counter anti-forensics, validate findings with multiple tools, and deploy network sniffers for real-time traffic analysis and data recovery.
Countermeasures - Part 30:17
Access and leverage resources to stay at the forefront of investigations, and commit to continual training to stay sharp and aware of new anti forensic techniques used by criminals.
Chapter 4 Quiz

Requirements

An interest in investigating cyber crimes and the basic knowledge of computers and ability to run software applications

Description

Computer hacking forensic investigation is the process of detecting hacking attempts and correctly obtaining evidence to investigate the crime and performing investigations to deter further attempts.

This course will allow both the established and new practitioners to build their existing and future career. Computer Hacking and Forensic Analysis is one of the most valued skillset in the area of network security, and possessing it raises one to an elite group of professionals.

This course is built for those involved in digital forensics to get a glimpse of the real realm of computer forensics examination.

Learn world class electronic discovery and professional investigative techniques, and hold computer forensic knowledge that will help organizations recognize, seize, preserve and present digital evidence.

Irrespective of the size of your company, computer forensics must be part of that system, indicating that the demand for highly trained computer forensics specialists continues to grow.

Become a professional today, SIGN UP NOW!

Who this course is for:

All IT professionals involved with information system security, computer forensics, and incident response.

Forensic Investigator Fundamentals

What you'll learn

Explore related topics

Course content

Chapter 01 - Computer Forensics Basics9 lectures • 1hr 22min

Chapter 02 - The Investigation Process9 lectures • 1hr 9min

Chapter 03 - Hard Disks and File Systems9 lectures • 1hr

Chapter 04 - Data Acquisition and Anti-Forensics18 lectures • 1hr 27min

Requirements

Description

Who this course is for: