
Introduction lecture for Intermediate Computer Forensics to discuss the topics that will be covered as well as the way the course will be taught.
A discussions of the differences and nuances of a public vs private investigations.
Explore core forensic concepts using open source and free tools, prioritizing accessibility and budget-friendly learning on Windows, with emphasis on understanding tools over costly suites.
Autopsy by Sleuthkit serves as the primary open-source forensic suite for this course; download from sleuthkit.org/autopsy, use version 4.5.0, follow along, and explore other tools such as file carving.
Explore using the open source file carving tool Scalpel to extract carved JPEGs and other files from an image via command line, with configurable settings and potential evidence.
Explore web browser forensics by using Autopsy to analyze bookmarks, cookies, history, and web searches, and map urls via index.dat to reveal where users went and when.
Discover how to recover evidence from the Windows recycle bin with rifiuti2, a forensics tool that extracts info2 data like deletion time, original path, and file size for Autopsy analysis.
Review investigations and software concepts, compare open source autopsy with paid tools, and summarize image analysis, file carving, thumbs db, web history, and final reporting.
This course is designed for people with a working knowledge of computer forensics but looking to go deeper into specific skill and techniques of the the field. This is the second course following my pervious course Computer Forensics Fundamentals. While that course is recommended it is not required to take this course as they are independent in regard to topics taught.
The course will consist of presentations to explain the concepts of computer forensics as well as demonstrations of proper software and collections of digital evidence.
This course is designed for anyone with an interest computer forensics to get a deeper taste of the real world of digital forensics examination.
As an intermediate course it will consist of presentations, hands on lessons and quizs.