Course Outline

· Introduction

· Computer Forensic Incidents

· Investigation Process

· OS Disk Storage Concepts

· Digital Acquisition and Analysis

· Forensic Examination Protocols

· Digital Evidence Protocols

· CFI Theory

· Digital Evidence Presentation

· Computer Forensics Lab Protocols

· CF Processing Techniques

· Digital Forensics Reporting

· Specialized Artifact Recovery

· eDiscovery and ESI

· Cell Phone Forensics

· USB Forensics

· Incident Handling

Lab Outline

· Preparing Forensic Workstation

§ AccessData FTK Imager Installation

§ Autopsy Installation

§ National Software Reference Library (NSRL) for autopsy

§ 7z Installation

§ Install Registry Viewer

§ Install Password Recovery Tool Kit (PRTK – 5.21)

· Mile2 - Lab 2: Chain of Custody

§ Chain of Custody Search and Seizure

§ Chain of Custody Forensic Imaging

· Imaging Case Evidence / FTK Imager

· Create a new case for Autopsy

§ Creating a Case in Autopsy

· Reviewing Evidence / Autopsy (Case #1)

§ User MTBG attempting to hack his/her previous employer

§ Reviewing Evidence in Autopsy

§ Case Study scenario:

§ The evidence you are required to discover (Challenge)

§ Final Report for MTBG case

· Reviewing Evidence / Autopsy (Case #2)

§ Greg Schardt case

§ Case Study Scenario:

§ The evidence you are required to discover (Challenge)

§ Final Report for Greg Schardt case