
Introduction lecture for Intermediate Computer Forensics to discuss the topics that will be covered as well as the way the course will be taught.
A discussions of the differences and nuances of a public vs private investigations.
Explore core forensic concepts using open source and free tools, prioritizing accessibility and budget-friendly learning on Windows, with emphasis on understanding tools over costly suites.
Autopsy by Sleuthkit serves as the primary open-source forensic suite for this course; download from sleuthkit.org/autopsy, use version 4.5.0, follow along, and explore other tools such as file carving.
Use Autopsy to create a new forensic case, ingest an image, and explore extracted data—recent activity, web history, cookies, encrypted files, and timeline insights.
Use keyword search in Autopsy to find evidence in a mounted image with exact match. Also apply keyword lists like drugs, review hits, and tag findings within the case warrant.
Explore how thumbs.db stores thumbnail previews for folders, and reveals evidence of files once present, even after deletion, using Autopsy and other viewing tools.
Explore using the open source file carving tool Scalpel to extract carved JPEGs and other files from an image via command line, with configurable settings and potential evidence.
Explore how Thumbs.db stores thumbnail images and how Autopsy with Sleuth Kit Python add-ons parses them to reveal previously viewed files, even after deletion.
Explore web browser forensics by using Autopsy to analyze bookmarks, cookies, history, and web searches, and map urls via index.dat to reveal where users went and when.
Investigate how the recycling bin preserves deleted files, how delete and shift+delete affect recovery, and how forensic tools like FTK Imager read $Recycle.Bin or INFO2 structures to recover data.
Discover how to recover evidence from the Windows recycle bin with rifiuti2, a forensics tool that extracts info2 data like deletion time, original path, and file size for Autopsy analysis.
Explore how Autopsy reveals deleted files on disk images, using file type and deleted file views to locate names, locations, and potential browser forensics clues.
Review investigations and software concepts, compare open source autopsy with paid tools, and summarize image analysis, file carving, thumbs db, web history, and final reporting.
This course is designed for people with a working knowledge of computer forensics but looking to go deeper into specific skill and techniques of the the field. This is the second course following my pervious course Computer Forensics Fundamentals. While that course is recommended it is not required to take this course as they are independent in regard to topics taught.
The course will consist of presentations to explain the concepts of computer forensics as well as demonstrations of proper software and collections of digital evidence.
This course is designed for anyone with an interest computer forensics to get a deeper taste of the real world of digital forensics examination.
As an intermediate course it will consist of presentations, hands on lessons and quizs.