Learning Cyber Incident Response and Digital Forensics

Learn the basics of how an incident response is conducted, including how evidence is collected for further digital forensic investigation.

Learning Cyber Incident Response and Digital Forensics

• Overview
• Getting started

1. Fundamentals of Digital Forensics

• Digital forensics
• What is cybercrime?
• Digital forensics investigations
• Types of evidence
• Best practices
• Review of the chapter quiz

2. Selecting Forensic Tools

• Selecting forensic tools
• Types of forensic tools
• Commercial vs. open-source forensic tools
• Legal considerations
• Building a forensic toolkit
• Review of the chapter quiz

3. Digital Forensic Investigation

• Digital forensic investigation
• Preserving evidence
• Preparing an evidence drive
• Creating a trusted tools USB drive
• Collecting volatile evidence
• Collecting network evidence
• Imaging storage devices with FTK
• Imaging a USB drive with DD
• Review of the chapter quiz

4. Conducting Forensic Analysis

• Conducting forensic analysis
• Analyzing memory contents
• Importing evidence into Autopsy
• Analyzing hidden and deleted files
• Analyzing the windows registry
• Conducting log analysis
• Creating your report
• Other considerations
• Review of the chapter quiz

5. Cyber Incident Response

• Cyber incident response
• Preparation phase
• Detection and analysis phase
• Containment, eradication, and recovery phase
• Post-incident activity phase
• Review of the chapter quiz

6. Conducting a Cyber Incident Response

• Conducting a cyber incident response
• Static analysis with floss
• Dynamic analysis with Autoruns
• Investigating the scheduled task
• Packet analysis with Wireshark and process monitoring
• Files and folders created
• Static analysis with IDA and OllyDbg
• Static analysis with process dump
• Malware IoC research
• Review of the chapter quiz

Conclusion

• What to do next