Module 01 : Computer Forensics in Today’s World

1.1. Understand the Fundamentals of Computer Forensics

▪ Understanding Computer Forensics
▪ Need for Computer Forensics
▪ Why and When Do You Use Computer Forensics?

1.2. Understand Cybercrimes and their Investigation Procedures

▪ Types of Cybercrimes
o Examples of Cybercrimes
▪ Impact of Cybercrimes at the Organizational Level
▪ Cybercrime Investigation
o Civil vs. Criminal Investigation
o Administrative Investigation

1.3. Understand Digital Evidence

▪ Introduction to Digital Evidence
▪ Types of Digital Evidence
▪ Roles of Digital Evidence
▪ Sources of Potential Evidence
▪ Rules of Evidence
▪ Best Evidence Rule
▪ Federal Rules of Evidence (United States)
▪ Scientific Working Group on Digital Evidence (SWGDE)
▪ The Association of Chief Police Officers (ACPO) Principles of Digital Evidence

1.4. Understand Forensic Readiness, Incident Response and the Role of SOC (Security Operations Center) in Computer Forensics

▪ Forensic Readiness
▪ Forensic Readiness and Business Continuity
▪ Forensics Readiness Planning
▪ Incident Response
▪ Computer Forensics as a part of Incident Response Plan
▪ Overview of Incident Response Process Flow
▪ Role of SOC in Computer Forensics

1.5. Identify the Roles and Responsibilities of a Forensic Investigator

▪ Need for a Forensic Investigator
▪ Roles and Responsibilities of a Forensics Investigator
▪ What Makes a Good Computer Forensics Investigator?
▪ Code of Ethics
▪ Accessing Computer Forensics Resources

1.6. Understand the Challenges Faced in Investigating Cybercrimes

▪ Challenges Cybercrimes Pose to Investigators
▪ Other Factors That Influence Forensic Investigations
▪ Computer Forensics: Legal Issues
▪ Computer Forensics: Privacy Issues

1.7. Understand Legal Compliance in Computer Forensics

▪ Computer Forensics and Legal Compliance
▪ Other Laws Relevant to Computer Forensics

Module 02: Computer Forensics Investigation Process

2.1. Understand the Forensic Investigation Process and its Importance

▪ Forensic Investigation Process
▪ Importance of the Forensic Investigation Process

2.2. Understand the Pre-investigation Phase

▪ Setting Up a Computer Forensics Lab
▪ Building the Investigation Team
▪ Understanding the Hardware and Software Requirements of a Forensic Lab
▪ Validating Laboratory Software and Hardware
▪ Ensuring Quality Assurance

2.3. Understand First Response

▪ First Response Basics
▪ First Response by Non-forensics Staff
▪ First Response by System/Network Administrators
▪ First Response by Laboratory Forensics Staff

2.4. Understand the Investigation Phase

▪ Documenting the Electronic Crime Scene
o Documenting the Electronic Crime Scene
o Photographing and Sketching the Scene
▪ Search and Seizure
o Search and Seizure Process Flow
o Planning the Search and Seizure
o Seeking Consent
o Obtaining Witness Signatures
o Obtaining Warrant for Search and Seizure
o Example of a Search Warrant
o Searches Without a Warrant
o Collecting Incident Information
o Initial Search of the Scene
o Securing and Evaluating the Crime Scene: A Checklist
o Seizing Evidence at the Crime Scene
o Dealing with Powered-On Computers
o Dealing with Powered-Off Computers
o Dealing with Networked Computers
o Dealing with Open Files and Startup Files
o Operating System Shutdown Procedure
o Dealing with Smartphones or Other Handheld Devices
▪ Evidence Preservation
o Preserving Evidence
o Chain of Custody

o Simple Format of the Chain of Custody Document
o Chain of Custody Form
o Chain of Custody on Property Evidence Envelope/Bag and Sign-out Sheet
o Evidence Bag Contents List
o Packaging Evidence
o Exhibit Numbering
o Determining the Location for Evidence Examination
o Transporting and Storing Evidence
▪ Data Acquisition
o Acquiring the Data
o Duplicating the Data (Imaging)
▪ Data Analysis
o Analyzing the Data
▪ Case Analysis
o Analysis of the Case
o Evidence Reconstruction
o Collecting Evidence from Social Networks

2.5. Understand the Post-investigation Phase>/strong>

▪ Reporting
o Gathering and Organizing Information
o Writing the Investigation Report
o Forensic Investigation Report Template
o Guidelines for Writing a Report
▪ Testify as an Expert Witness
o Who is an Expert Witness?
o Roles of an Expert Witness
o What Makes a Good Expert Witness?
o Testifying in the Court
o General Ethics while Testifying

Module 03: Understanding Hard Disks and File Systems

3.1. Describe Different Types of Disk Drives and their Characteristics

▪ Understanding Hard Disk Drive
o Tracks
o Sector
o 4K Sectors
o Data Density on a Hard Disk
o CHS (Cylinder-Head-Sector) Data Addressing and Disk Capacity Calculation
o Measuring the Hard Disk Performance
▪ Understanding Solid-State Drive (SSD)
▪ Disk Interfaces
o ATA/PATA (IDE/EIDE)
o Serial ATA/ SATA (AHCI)
o Serial Attached SCSI
o PCIe SSD
o SCSI

3.2. Explain the Logical Structure of a Disk

▪ Logical Structure of Disks
o Clusters
o Lost Clusters
o Slack Space
o Master Boot Record (MBR)
o Structure of a Master Boot Record
o Disk Partitions
o BIOS Parameter Block (BPB)
o Globally Unique Identifier (GUID)
▪ GUID Partition Table (GPT)

3.3. Understand Booting Process of Windows, Linux and Mac Operating Systems

▪ What is the Booting Process?
▪ Essential Windows System Files
▪ Windows Boot Process: BIOS-MBR Method
o Identifying the MBR Partition
▪ Windows Boot Process: UEFI-GPT
o Identifying the GUID Partition Table (GPT)
o Analyzing the GPT Header and Entries
o GPT Artifacts
▪ Macintosh Boot Process
▪ Linux Boot Process

3.4. Understand Various File Systems of Windows, Linux and Mac Operating Systems

▪ Windows File Systems
o File Allocation Table (FAT)
▪ FAT File System Layout
▪ FAT Partition Boot Sector
▪ FAT Folder Structure
▪ Directory Entries and Cluster Chains
▪ Filenames on FAT Volumes
▪ FAT32
o New Technology File System (NTFS)
▪ NTFS Architecture
▪ NTFS System Files
▪ NTFS Partition Boot Sector
▪ Cluster Sizes of NTFS Volume
▪ NTFS Master File Table (MFT)
o Metadata Files Stored in the MFT
▪ NTFS Attributes
▪ NTFS Data Stream
▪ NTFS Compressed Files
▪ Encrypting File Systems (EFS)
o Components of EFS
o EFS Attribute
▪ Sparse Files
▪ Linux File Systems
o Linux File System Architecture
o Filesystem Hierarchy Standard (FHS)
o Extended File System (ext)
o Second Extended File System (ext2)
o Third Extended File System (ext3)
o Journaling File System
o Fourth Extended File System (ext4)
o Understanding Superblocks, Inodes, and Data Blocks
▪ Mac OS X File Systems
o Hierarchical File System Plus (HFS+)
▪ HFS Plus Volumes
▪ HFS Plus Journal
o Apple File System (APFS)
▪ Major Components of APFS
▪ APFS vs. HFS Plus
▪ CD-ROM/DVD File System
▪ Virtual File System (VFS) and Universal Disk Format (UDF) File System

3.5. Examine File System Using Autopsy and The Sleuth Kit Tools

▪ File System Analysis Using Autopsy
▪ File System Analysis Using The Sleuth Kit (TSK)
o The Sleuth Kit (TSK): fsstat
o The Sleuth Kit (TSK): istat
o The Sleuth Kit (TSK): fls and img_stat

3.6. Understand Storage Systems

▪ RAID Storage System
o Levels of RAID Storage System
o Just a Bunch of Drives/Disks (JBOD)
o Host Protected Areas (HPA) and Device Configuration Overlays (DCO)
▪ NAS/SAN Storage
o Network-Attached Storage (NAS)
o Storage Area Network (SAN)

o Differences between NAS and SAN

3.7. Understand Encoding Standards and Hex Editors

▪ Character Encoding Standard: ASCII
▪ Character Encoding Standard: UNICODE
▪ OFFSET
▪ Understanding Hex Editors
▪ Understanding Hexadecimal Notation

3.8. Analyze Popular File Formats Using Hex Editor

▪ Image File Analysis: JPEG
▪ Image File Analysis: BMP
▪ Hex View of Popular Image File Formats
▪ PDF File Analysis
▪ Word File Analysis
▪ PowerPoint File Analysis
▪ Excel File Analysis
▪ Hex View of Other Popular File Formats
▪ Hex View of Popular Video File Formats
▪ Hex View of Popular Audio File Formats
Module 04: Data Acquisition and Duplication

4.1. Understand Data Acquisition Fundamentals

▪ Understanding Data Acquisition
▪ Live Acquisition
▪ Order of Volatility
▪ Dead Acquisition
▪ Rules of Thumb for Data Acquisition
▪ Types of Data Acquisition
o Logical Acquisition
o Sparse Acquisition
o Bit-Stream Imaging
▪ Bit-stream disk-to-image file
▪ Bit-stream disk-to-disk
▪ Determine the Data Acquisition Format
o Raw Format
o Proprietary Format
o Advanced Forensics Format (AFF)
o Advanced Forensic Framework 4 (AFF4)

4.2. Understand Data Acquisition Methodology

▪ Data Acquisition Methodology
▪ Step 1: Determine the Best Data Acquisition Method
▪ Step 2: Select the Data Acquisition Tool
▪ Step 3: Sanitize the Target Media
▪ Step 4: Acquire Volatile Data
o Acquire Volatile Data from a Windows Machine
o Acquire Volatile Data from a Linux Machine
▪ Acquire Volatile Data from a Linux Machine Using dd (Local Acquisition)
▪ Acquire Volatile Data from a Linux Machine Using dd and Netcat (Remote Acquisition)
▪ Acquire Volatile Data from a Linux Machine Using LiME (Local Acquisition)
▪ Acquire Volatile Data from a Linux Machine Using LiME and Netcat (Remote Acquisition)
o Acquire Volatile Data from a Mac Machine Using
▪ Digital Collector
▪ OSXpmem
▪ Step 5: Enable Write Protection on the Evidence Media
▪ Step 6: Acquire Non-volatile Data
o Using a Windows Forensic Workstation
o Using a Linux Forensic Workstation
o Using macOS – Single User Mode
o Using macOS – Target Disk Mode
o Using a Linux Bootable CD/USB
o Using Digital Collector
o Acquiring RAID Disks
Step 7: Plan for Contingency
▪ Step 8: Validate Data Acquisition Using
o Windows Validation Methods
o Linux/Mac Validation Methods

4.3. Prepare an Image File for Examination

▪ Preparing an Image for Examination
o Scenario 1: The Acquired Evidence is in E01 Format and the Forensic Workstation is Linux
o Scenario 2: The Acquired Evidence Needs to be Converted to a Bootable VM
o Scenario 3: The Acquired Physical Hard Disk Contains Windows File System and the Forensic Workstation is Linux
o Scenario 4: The Acquired Evidence Contains APFS file system and the Forensic Workstation is Linux
▪ Viewing an Image on a Windows, Linux and Mac Forensic Workstations

Module 05: Defeating Anti-forensics Techniques

5.1. Understand Anti-forensics Techniques

▪ What is Anti-forensics?
▪ Anti-forensics Techniques

5.2. Discuss Data Deletion and Recycle Bin Forensics

▪ Anti-forensics Technique: Data/File Deletion
▪ What Happens When a File is Deleted in Windows?
▪ Recycle Bin in Windows
o Recycle Bin Forensics

5.3. Illustrate File Carving Techniques and Ways to Recover Evidence from Deleted Partitions

▪ File Carving
o File Carving on Windows
▪ SSD File Carving on Windows File System
▪ HDD File Carving on Windows File System
▪ File Recovery Tools: Windows
o File Carving on Linux

▪ SSD File Carving on Linux File System
▪ File Recovery Tools: Linux
o File Carving on macOS
▪ SSD File Carving on Apple File System
▪ File Recovery Tools: macOS
▪ Recovering Deleted Partitions
o Recovering Deleted Partitions: Using R-Studio
o Recovering Deleted Partitions: Using EaseUS Data Recovery Wizard
o Partition Recovery Tools

5.4. Explore Password Cracking/Bypassing Techniques

▪ Anti-forensics Technique: Password Protection
▪ Using Rainbow Tables to Crack Hashed Passwords
o Tool to Create Rainbow Tables: Winrtgen
▪ Password Cracking: Using L0phtCrack and Ophcrack
▪ Password Cracking: Using Cain & Abel and RainbowCrack
▪ Password Cracking: Using PwDump7
▪ Password Cracking Tools
▪ Bypassing Passwords on Powered-off Computer
o Bypassing BIOS Passwords
o Bypassing BIOS Passwords by Resetting CMOS Using Jumpers
o Bypassing BIOS Passwords by Removing CMOS Battery
▪ Tool to Reset Admin Password
o Lazesoft Recover My Password
o Bypassing Windows User Password: Lazesoft Recovery Suite
o Bypassing Windows User Password by Booting Live CD/USB
o Application Password Cracking Tools

5.5. Detect Steganography, Hidden Data in File System Structures, Trail Obfuscation, and File Extension Mismatch

▪ Anti-forensics Technique: Steganography
o Defeating Anti-forensics: Steganalysis
o Steganalysis Methods/Attacks on Steganography

o Detecting Steganography (Text, Image, Audio, and Video Files)
o Steganography Detection Tools
▪ Defeating Anti-forensics Technique: Detecting Data Hiding in File System Structures Using OSForensics
▪ Anti-forensics Technique: Alternate Data Streams
o Defeating Anti-forensics Technique: Detecting Alternate Data Streams
o Defeating Anti-forensics Technique: Detecting Alternate Data Streams Using Stream Detector
▪ Anti-forensics Technique: Trail Obfuscation
▪ Defeating Anti-forensics Technique: Detecting File Extension Mismatch Using Autopsy

5.6. Understand Techniques of Artifact Wiping, Overwritten Data/Metadata Detection, and Encryption

▪ Anti-forensics Technique: Artifact Wiping
▪ Anti-forensics Technique: Overwriting Data/Metadata
o Defeating Anti-forensics Technique: Detecting Overwritten Data/Metadata
▪ Anti-forensics Technique: Encryption
o Recover Encrypted Files Using Advanced EFS Data Recovery Tool

5.7. Detect Program Packers and Footprint Minimizing Techniques

▪ Anti-forensics Technique: Program Packers
o Unpacking Program Packers
▪ Anti-forensics Techniques that Minimize Footprint
o Defeating Anti-forensics Technique: Detecting USB Devices

5.8. Understand Anti-forensics Countermeasures

Module 06: Windows Forensics

6.1. Collect Volatile and Non-volatile Information

▪ Collecting Volatile Information
o Collecting System Time
o Collecting Logged-On Users
▪ PsLoggedOn Tool
▪ net sessions Command
▪ LogonSessions Tool
o Collecting Open Files
▪ net file Command
▪ Using NetworkOpenedFiles
o Collecting Network Information
o Collecting Information about Network Connections
o Process Information
o Process-to-Port Mapping
o Examining Process Memory
o Collecting Network Status
o Examining Print Spool files
o Collecting Clipboard Contents and Service/Driver Information
o Collecting Command History and Locally Shared Resource Information
▪ Collecting Non-volatile Information
o Examining File Systems
o ESE Database File
▪ Examining .edb File Using ESEDatabaseView
o Windows Search Index Analysis
o Detecting Externally Connected Devices to the System
o Slack Space
o Collecting Hidden Partition Information
o Other Non-volatile Information
o Analyzing Windows Thumbnail Cache

6.2. Perform Windows Memory and Registry Analysis

▪ Windows Crash Dump
▪ Collecting Process Memory
▪ Random Access Memory (RAM) Acquisition
▪ Memory Forensics
o Malware Analysis Using Redline
o Malware Analysis Using Volatility Framework
o Virtual Memory Acquisition Using FTK Imager
o Page File

▪ Examining Pagefile Using Strings Command
o Hibernate Files
▪ Windows Registry Analysis
o Windows Registry
o Registry Structure within a Hive File
o Windows Registry: Forensic Analysis
o The Registry as a Log File
o Collecting System Information
o Collecting Last Shutdown Time and Time Zone Information
o Shares
o Wireless SSIDs
o Startup Locations
o System Boot
o Importance of Volume Shadow Copy Services
o User Login
o Microsoft Security ID
o User Activity
o Enumerating Autostart Registry Locations
o Registry Settings
o USB Removable Storage Devices
o Mounted Devices
o Tracking User Activity
o The UserAssist Keys
o MRU Lists
o Connecting to Other Systems
o Analyzing Restore Point Registry Settings
o Determining the Startup Locations

6.3. Examine the Cache, Cookie and History Recorded in Web Browsers

▪ Cache, Cookie, and History Analysis: Mozilla Firefox
o Analysis Tool: MZCacheView
o Analysis Tool: MZCookiesView
o Analysis Tool: MZHistoryView
▪ Cache, Cookie, and History Analysis: Google Chrome
o Analysis Tool: ChromeCacheView
o Analysis Tool: ChromeCookiesView
o Analysis Tool: ChromeHistoryView
▪ Cache, Cookie, and History Analysis: Microsoft Edge
o Analysis Tool: IECacheView
o Analysis Tool: EdgeCookiesView
o Analysis Tool: BrowsingHistoryView

6.4. Examine Windows Files and Metadata

▪ Windows File Analysis
o System Restore Points (Rp.log Files)
o System Restore Points (Change.log.x Files)
o Prefetch Files
▪ Examining Prefetch Files Using WinPrefetchView
o Image Files
o Understanding EXIF Data
▪ Metadata Investigation
o Understanding Metadata
o Metadata in Different File Systems
o Metadata in PDF Files
o Metadata in Word Documents
o Metadata Analysis Tool: Metashield Analyzer

6.5. Understand ShellBags, LNK Files, and Jump Lists

▪ Windows ShellBags
o Windows ShellBags: Forensic Analysis
o Parsing ShellBags: Using ShellBags Explorer Tool
▪ Analyzing LNK Files
o Analyzing LNK files: LECmd Tool
▪ Analyzing Jump Lists
o Analyzing Jump Lists: JumpListExt Tool

6.6. Understand Text-based Logs and Windows Event Logs

▪ Understanding Events
▪ Types of Logon Events
▪ Event Log File Format
▪ Organization of Event Records
▪ ELF_LOGFILE_HEADER Structure
▪ EventLogRecord Structure
▪ Windows 10 Event Logs
▪ Evaluating Account Management Events
▪ Event Logs
o Examining System Log Entries
o Examining Application Log Entries
o Searching with Event Viewer
o Using Event Log Explorer to Examine Log Files
o Windows Event Log Files Internals
o Examining Removable Storage Using Event Viewer
▪ Windows Forensics Tools
o OSForensics
o Kroll Artifact Parser and Extractor (KAPE)
▪ Hashing it Out in PowerShell: Using Get-FileHash

Module 07: Linux and Mac Forensics

7.1. Understand Volatile and Non-volatile Data in Linux

▪ Introduction to Linux Forensics
▪ Collecting Volatile Data
o Collecting Hostname, Date, and Time
o Collecting Uptime Data
o Collecting Network Information
o Viewing Network Routing Tables
o Collecting Open Port Information
o Finding Programs/Processes Associated with a Port
o Collecting Data on Open Files
o Collecting Mounted File System Information
o Finding Loaded Kernel Modules
o Collecting User Events and Reading ELF Files
o Viewing Running Processes in the System
o Collecting Swap Areas and Disk Partition Information
o Collecting Kernel Messages
▪ Collecting Non-volatile Data
o Collecting System Information
o Collecting Kernel Information
o Collecting User Account Information
o Collecting Currently Logged-in Users and Login History Information
o Collecting System Logs Data
o Linux Log Files
o Collecting User History File Information and Viewing Hidden Files and Directories
o Collecting Suspicious Information
o File Signature Analysis
o Usage of File and Strings Command
o Using find Command to Find Writable Files

7.2. Analyze Filesystem Images Using The Sleuth Kit

▪ File System Analysis Using The Sleuth Kit
o fsstat
o fls
o istat

7.3. Demonstrate Memory Forensics Using Volatility & PhotoRec

▪ Memory Forensics
o Introduction
o Collecting Network Information
o Listing Open Files
o Collecting Bash Information
o Collecting System Information
o Collecting Kernel Memory Information
o Malware Analysis Using Volatility Framework
o Carving Memory Dumps Using PhotoRec Tool

7.4. Understand Mac Forensics

▪ Introduction to Mac Forensics
▪ Mac Forensics Data
▪ Mac Log Files
▪ Mac Directories
▪ APFS Analysis: Biskus APFS Capture
▪ Parsing Metadata on Spotlight
▪ Mac Forensics Tools

Module 08: Network Forensics

8.1. Understand Network Forensics

▪ Introduction to Network Forensics
▪ Postmortem and Real-Time Analysis
▪ Network Attacks
▪ Indicators of Compromise (IOCs)
▪ Where to Look for Evidence
▪ Types of Network-based Evidence

8.2. Explain Logging Fundamentals and Network Forensic Readiness

▪ Log Files as Evidence
▪ Legal Criteria for Admissibility of Logs as Evidence
▪ Records of Regularly Conducted Activity as Evidence
▪ Guidelines to Ensure Log File Credibility and Usability
▪ Ensure Log File Authenticity
▪ Maintain Log File Integrity
▪ Implement Centralized Log Management
o Centralized Logging Best Practices
o Centralized Log Management Challenges
o Addressing the Challenges in Centralized Log Management

8.3. Summarize Event Correlation Concepts

▪ Event Correlation
▪ Types of Event Correlation
▪ Prerequisites of Event Correlation
▪ Event Correlation Approaches

8.4. Identify Indicators of Compromise (IoCs) from Network Logs

▪ Analyzing Firewall Logs
o Analyzing Firewall Logs: Cisco
o Analyzing Firewall Logs: Check Point
▪ Analyzing IDS Logs
o Analyzing IDS Logs: Juniper
o Analyzing IDS Logs: Check Point
▪ Analyzing Honeypot Logs
▪ Analyzing Router Logs
o Analyzing Router Logs: Cisco
o Analyzing Router Logs: Juniper
▪ Analyzing DHCP Logs

8.5. Investigate Network Traffic

▪ Why Investigate Network Traffic?
▪ Gathering Evidence via Sniffers
▪ Sniffing Tool: Tcpdump
▪ Sniffing Tool: Wireshark
o Display Filters in Wireshark
▪ Analyze Traffic for TCP SYN Flood DoS Attack
▪ Analyze Traffic for SYN-FIN Flood DoS Attack
▪ Analyze Traffic for FTP Password Cracking Attempts
▪ Analyze Traffic for SMB Password Cracking Attempts
▪ Analyze Traffic for Sniffing Attempts
o Analyze Traffic for MAC Flooding Attempt
o Analyze Traffic for ARP Poisoning Attempt
▪ Analyze Traffic to Detect Malware Activity

8.6. Perform Incident Detection and Examination with SIEM Tools

▪ Centralized Logging Using SIEM Solutions
▪ SIEM Solutions: Splunk Enterprise Security (ES)
▪ SIEM Solutions: IBM QRadar
▪ Examine Brute-force Attacks
▪ Examine DoS Attack
▪ Examine Malware Activity
▪ Examine Data Exfiltration Attempts over FTP
▪ Examine Network Scanning Attempts
▪ Examine Ransomware Attack
▪ Detect Rogue DNS Server (DNS Hijacking/DNS Spoofing)

8.7. Monitor and Detect Wireless Network Attacks

▪ Wireless Network Security Vulnerabilities
▪ Monitoring for Attacks and Vulnerabilities
▪ Detect Rogue Access Points
▪ Detect Access Point MAC Address Spoofing Attempts
▪ Detect Misconfigured Access Points
▪ Detect Honeypot Access Points
▪ Detect Signal Jamming Attack

Module 09: Investigating Web Attacks

9.1. Understand Web Application Forensics

▪ Introduction to Web Application Forensics
▪ Challenges in Web Application Forensics
▪ Indications of a Web Attack
▪ Web Application Threats
▪ Web Attack Investigation Methodology

9.2. Understand Internet Information Services (IIS) Logs

▪ IIS Web Server Architecture
▪ IIS Logs
▪ Analyzing IIS Logs

9.3. Understand Apache Web Server Logs

▪ Apache Web Server Architecture
▪ Apache Web Server Logs
▪ Apache Access Logs
o Analyzing Apache Access Logs
▪ Apache Error Logs
o Analyzing Apache Error Logs

9.4. Understand the Functionality of Intrusion Detection System (IDS)

▪ Intrusion Detection System (IDS)
▪ How IDS Detects an Intrusion
▪ Intrusion Detection Tool: Snort
▪ Snort Rules

9.5. Understand the Functionality of Web Application Firewall (WAF)
▪ Web Application Firewall (WAF)
▪ Benefits of WAF
▪ Limitations of WAF
▪ WAF Tool: ModSecurity
▪ Types of ModSecurity Data Formats
o Analyzing ModSecurity Alerts
o Analyzing ModSecurity Audit Logs

9.6. Investigate Web Attacks on Windows-based Servers

▪ Investigating Web Attacks on Windows-based Servers

9.7. Detect and Investigate Various Attacks on Web Applications

▪ Investigating Cross-Site Scripting (XSS) Attack
o Investigating XSS: Using Regex to Search XSS Strings
o Examining Apache Logs for XSS Attack
o Examining IIS Logs for XSS Attack
o Examining Snort Alert Logs for XSS Attack
o Examining WAF Logs for XSS Attack
o Examining SIEM Logs for XSS Attack
▪ Investigating SQL Injection Attack
o Investigating SQL Injection Attack: Using Regex
o Examining Apache Logs for SQL Injection Attack
o Examining IIS Logs for SQL Injection Attack
o Examining Snort Alert Logs for SQL Injection Attack
o Examining WAF Logs for SQL Injection Attack
o Examining SIEM Logs for SQL Injection Attack
▪ Investigating Path/Directory Traversal Attack
o Examining Apache Logs for Path/Directory Traversal Attack
▪ Investigating Command Injection Attack
o Examining Apache Logs for Command Injection Attack
▪ Investigating XML External Entity (XXE) Attack
o Examining Apache Log File for XXE Attack
▪ Investigating Brute-force Attack
o Examining Apache Log File for Brute-force Attack

Module 10: Dark Web Forensics

10.1. Understand the Dark Web

▪ Understanding the Dark Web
▪ Tor Relays
▪ Working of the Tor Browser
▪ Tor Bridge Node

10.2. Determine How to Identify the Traces of Tor Browser during Investigation

▪ Dark Web Forensics
▪ Identifying Tor Browser Artifacts: Command Prompt
▪ Identifying Tor Browser Artifacts: Windows Registry
▪ Identifying Tor Browser Artifacts: Prefetch Files

10.3. Perform Tor Browser Forensics

▪ Tor Browser Forensics: Memory Acquisition
▪ Collecting Memory Dumps
▪ Memory Dump Analysis: Bulk Extractor
▪ Forensic Analysis of Memory Dumps to Examine Email Artifacts (Tor Browser Open)
▪ Forensic Analysis of Storage to Acquire Email Attachments (Tor Browser Open)
▪ Forensic Analysis of Memory Dumps to Examine Email Artifacts (Tor Browser Closed)
▪ Forensic Analysis of Storage to Acquire Email Attachments (Tor Browser Closed)
▪ Forensic Analysis: Tor Browser Uninstalled
▪ Dark Web Forensics Challenges

Module 11: Database Forensics

11.1. Understand Database Forensics and its Importance

▪ Database Forensics and its Importance

11.2. Determine Data Storage and Database Evidence Repositories in MSSQL Server

▪ Data Storage in SQL Server
▪ Database Evidence Repositories

11.3. Collect Evidence Files on MSSQL Server

▪ Collecting Volatile Database Data
▪ Collecting Primary Data File and Active Transaction Logs Using SQLCMD
▪ Collecting Primary Data File and Transaction Logs
▪ Collecting Active Transaction Logs Using SQL Server Management Studio
▪ Collecting Database Plan Cache
▪ Collecting Windows Logs
▪ Collecting SQL Server Trace Files
▪ Collecting SQL Server Error Logs

11.4. Perform MSSQL Forensics

▪ Database Forensics Using SQL Server Management Studio
▪ Database Forensics Using ApexSQL DBA

11.5. Understand Internal Architecture of MySQL and Structure of Data Directory

▪ Internal Architecture of MySQL
▪ Structure of Data Directory

11.6. Understand Information Schema and List MySQL Utilities for Performing Forensic Analysis

▪ MySQL Forensics
▪ Viewing the Information Schema
▪ MySQL Utility Programs for Forensic Analysis

11.7. Perform MySQL Forensics on WordPress Web Application Database

▪ Common Scenario for Reference
▪ MySQL Forensics for WordPress Website Database: Scenario 1
o Collect the Evidence
o Examine the Log Files
o Analyze the General Log
o Take Backup of the Database
o Create Evidence Database
o Select Database
o View Tables in the Database
o View Users in the Database
o View Columns in the Table
o Collect Posts Made by the User
o Examine the Posts Made by the User
▪ MySQL Forensics for WordPress Website Database: Scenario 2
o Collect the Database and All the Logs
o Examine the Binary Logs
o wp_users.ibd in WordPress Database
o wp_posts.ibd in WordPress Database

Module 12: Cloud Forensics

12.1. Understand the Basic Cloud Computing Concepts

▪ Introduction to Cloud Computing
▪ Types of Cloud Computing Services
▪ Cloud Deployment Models
▪ Cloud Computing Threats
▪ Cloud Computing Attacks

12.2. Understand Cloud Forensics

▪ Introduction to Cloud Forensics
▪ Usage of Cloud Forensics
▪ Cloud Crimes
▪ Cloud Forensics: Stakeholders and their Roles
▪ Cloud Forensics Challenges
o Architecture and Identification
o Data Collection
o Logs
o Legal
o Analysis

12.3. Understand the Fundamentals of Amazon Web Services (AWS)
▪ Introduction to Amazon Web Services
▪ Division of Responsibilities in AWS
o Shared Responsibility Model for Infrastructure Services
o Shared Responsibility Model for Container Services
o Shared Responsibility Model for Abstracted Services
▪ Data Storage in AWS
▪ Logs in AWS

12.4. Determine How to Investigate Security Incidents in AWS

▪ Forensic Acquisition of Amazon EC2 Instance: Methodology
o Step 1: Isolate the Compromised EC2 Instance
o Step 2: Take a Snapshot of the EC2 Instance
o Step 3: Provision and Launch a Forensic Workstation
o Step 4: Create Evidence Volume from the Snapshot
o Step 5: Attach the Evidence Volume to the Forensic Workstation
o Step 6: Mount the Evidence Volume on the Forensic Workstation
▪ Investigating Log Files: CloudWatch Logs and S3 Server Access Logs

12.5. Understand the Fundamentals of Microsoft Azure

▪ Introduction to Microsoft Azure
▪ Division of Responsibilities in Azure
▪ Data Storage in Azure
▪ Logs in Azure

12.6. Determine How to Investigate Security Incidents in Azure

▪ Forensic Acquisition of VMs in Azure: Methodology
o Forensic Acquisition of VMs in Azure: The Scenario
o Step 1: Create a Snapshot of the OS Disk of the Affected VM via Azure Portal and Azure CLI
o Step 2: Copy the Snapshot to a Storage Account under a Different Resource Group
o Step 3: Delete the Snapshot from the Source Resource Group and Create a Backup Copy
o Step 4: Mount the Snapshot onto the Forensic Workstation
o Analyze the Snapshot via Autopsy

12.7. Understand Forensic Methodologies for Containers and Microservices

▪ What are Containers and Microservices?
▪ Challenges of Performing Forensics on Containers
▪ Container Forensics and Incident Response: Methodology
▪ Container Forensics Using Docker

Module 13: Investigating Email Crimes

13.1. Understand Email Basics

▪ Introduction to an Email System
▪ Components Involved in Email Communication
▪ How Email Communication Works?
▪ Understanding the Parts of an Email Message

13.2. Understand Email Crime Investigation and its Steps

▪ Introduction to Email Crime Investigation
▪ Steps to Investigate Email Crimes
o Step 1: Seizing the Computer and Email Accounts
o Step 2: Acquiring the Email Data
▪ Acquiring Email Data from Desktop-based Email Clients
o Local Email Files in Microsoft Outlook
o Local Email Files in Mozilla Thunderbird
o Acquiring Thunderbird Local Email Files via SysTools MailPro+
o Acquiring Outlook Email Files: .ost to .pst File Conversion
o Acquiring Outlook .pst File via SysTools MailPro+
▪ Acquiring Email Data from Web-based Email Accounts
o Step 3: Examining Email Messages
o Step 4: Retrieving Email Headers
▪ Retrieving Email Headers in Microsoft Outlook
▪ Retrieving Email Headers in Microsoft Outlook.com
▪ Retrieving Email Headers in AOL
▪ Retrieving Email Headers in Apple Mail
▪ Retrieving Email Headers in Gmail
▪ Retrieving Email Headers in Yahoo Mail
o Step 5: Analyzing Email Headers
▪ Analyzing Email Headers: X-Headers
▪ Analyzing Email Headers: Checking Email Authenticity
▪ Analyzing Email Headers: Examining the Originating IP Address
▪ Investigating a Suspicious Email
o Step 6: Recovering Deleted Email Messages
▪ Recovering Deleted Email Messages from Outlook .pst Files Using Paraben’s Electronic Evidence Examiner
▪ Recovering deleted Email Data from Thunderbird Using Paraben’s Electronic Evidence Examiner

13.3. U.S. Laws Against Email Crime

▪ U.S. Laws Against Email Crime: CAN-SPAM Act

Module 14: Malware Forensics

14.1. Define Malware and Identify the Common Techniques Attackers Use to Spread Malware

▪ Introduction to Malware
▪ Components of Malware
▪ Common Techniques Attackers Use to Distribute Malware across Web

14.2. Understand Malware Forensics Fundamentals and Recognize Types of Malware Analysis

▪ Introduction to Malware Forensics
▪ Why Analyze Malware?
▪ Malware Analysis Challenges
▪ Identifying and Extracting Malware
▪ Prominence of Setting Up a Controlled Malware Analysis Lab
▪ Preparing Testbed for Malware Analysis
▪ Supporting Tools for Malware Analysis
▪ General Rules for Malware Analysis
▪ Documentation Before Analysis
▪ Types of Malware Analysis

14.3. Understand and Perform Static Analysis of Malware

▪ Malware Analysis: Static
o Static Malware Analysis: File Fingerprinting
o Static Malware Analysis: Online Malware Scanning
o Online Malware Analysis Services
o Static Malware Analysis: Performing Strings Search
o Static Malware Analysis: Identifying Packing/Obfuscation Methods
o Static Malware Analysis: Finding the Portable Executables (PE) Information
▪ Analyzing Portable Executable File Using Pestudio
o Static Malware Analysis: Identifying File Dependencies
o Static Malware Analysis: Malware Disassembly
o Malware Analysis Tool: IDA Pro

14.4. Analyze Suspicious Word and PDF Documents

▪ Analyzing Suspicious MS Office Document
▪ Analyzing Suspicious PDF Document

14.5. Understand Dynamic Malware Analysis Fundamentals and Approaches

▪ Malware Analysis: Dynamic
o Dynamic Malware Analysis: Pre-Execution Preparation
o Monitoring Host Integrity
o Monitoring Host Integrity Using WhatChanged Portable
o Observing Runtime Behavior

14.6. Analyze Malware Behavior on System Properties in Real-time

▪ System Behavior Analysis: Monitoring Registry Artifacts
o Windows AutoStart Registry Keys
o Analyzing Windows AutoStart Registry Keys
▪ System Behavior Analysis: Monitoring Processes
▪ System Behavior Analysis: Monitoring Windows Services
▪ System Behavior Analysis: Monitoring Startup Programs
o Startup Programs Monitoring Tool: AutoRuns for Windows
▪ System Behavior Analysis: Monitoring Windows Event Logs
o Key Event IDs to Monitor
o Examining Windows Event logs
▪ System Behavior Analysis: Monitoring API Calls
▪ System Behavior Analysis: Monitoring Device Drivers
o Device Drivers Monitoring Tool: DriverView
▪ System Behavior Analysis: Monitoring Files and Folders
o File and Folder Monitoring Tool: PA File Sight
o File and Folder Integrity Checkers: FastSum and WinMD5

14.7. Analyze Malware Behavior on Network in Real-time

▪ Network Behavior Analysis: Monitoring Network Activities
o Monitoring IP Addresses
▪ Network Behavior Analysis: Monitoring Port
o Examining Open Ports
o Port Monitoring Tools: TCPView and CurrPorts
▪ Network Behavior Analysis: Monitoring DNS
o Examining DNS Entries
o DNS Monitoring Tool: DNSQuerySniffer

14.8. Describe Fileless Malware Attacks and How they Happen

▪ Introduction to Fileless Malware
▪ Infection Chain of Fileless Malware
▪ How Fileless Attack Works via Memory Exploits
▪ How Fileless Attack Happens via Websites
▪ How Fileless Attack Happens via Documents

14.9. Perform Fileless Malware Analysis – Emotet

▪ Fileless Malware Analysis: Emotet
▪ Emotet Malware Analysis
▪ Emotet Malware Analysis: Timeline of the Infection Chain

Module 15: Mobile Forensics

15.1. Understand the Importance of Mobile Device Forensics

▪ Mobile Device Forensics
▪ Why Mobile Forensics?
▪ Top Threats Targeting Mobile Devices
▪ Mobile Hardware and Forensics
▪ Mobile OS and Forensics

15.2. Illustrate Architectural Layers and Boot Processes of Android and iOS Devices

▪ Architectural Layers of Mobile Device Environment
▪ Android Architecture Stack
▪ Android Boot Process
▪ iOS Architecture
▪ iOS Boot Process
o Normal and DFU Mode Booting
o Booting iPhone in DFU Mode
o Booting iPhone in Recovery Mode

15.3. Explain the Steps Involved in Mobile Forensics Process

▪ Mobile Forensics Process
o Collect the Evidence
o Document the Evidence
o Preserve the Evidence
o Mobile Storage and Evidence Locations
o Data Acquisition Methods

15.4. Investigate Cellular Network Data

▪ Components of Cellular Network
▪ Different Cellular Networks
▪ Cell Site Analysis: Analyzing Service Provider Data
▪ CDR Contents

15.5. Understand SIM File System and its Data Acquisition Method

▪ Subscriber Identity Module (SIM)
o SIM File System
o Data Stored in a SIM
o Integrated Circuit Card Identification (ICCID)
o International Mobile Equipment Identifier (IMEI)
o SIM Cloning
o SIM Data Acquisition Using Oxygen Forensic Extractor
o SIM Data Acquisition Tools

15.6. Illustrate Phone Locks and Discuss Rooting of Android and Jailbreaking of iOS Devices

o Phone Locking on Android
o Phone Locking on iOS
o Rooting of Android Devices
o Jailbreaking of iOS Devices
o Risks of Jailbreaking
o Types of Jailbreaks
o Semi-tethered Jailbreaking Using Checkra1n

15.7. Perform Logical Acquisition on Android and iOS Devices

▪ Logical Acquisition
o Android Debug Bridge (ADB)
o Steps Involved in Android Forensics Process
o Logical Acquisition of Android Devices: Using “adb pull” Command
o Logical Acquisition of Android Devices: Using Commercial Tools
o Logical Acquisition Tools
o Steps Involved in iOS Forensics Process
o Logical Acquisition of iOS Devices: Using iTunes Backup
o Logical Acquisition of iOS Devices: Using Commercial Tools
▪ Cloud Data Acquisition on Android and iOS Devices
▪ Cloud Data Acquisition: Using Commercial Tools

15.8. Perform Physical Acquisition on Android and iOS Devices

▪ Physical Acquisition
o Physical Acquisition of Android Devices: Using DD Command
o Physical Acquisition of Android Devices: Using ADB, Busybox, Netcat
o Physical Acquisition of Android Devices: Using Commercial Tools
o Android Forensic Analysis: Using Commercial Tools
o Physical Acquisition of iOS Devices: Using SSH, Netcat
o Physical Acquisition of iOS Devices: Using Commercial Tools
o iOS Forensic Analysis: Using Commercial Tools
▪ SQLite Database Extraction
o SQLite Database Browsing Tools: Oxygen Forensics SQLite Viewer
o SQLite Database Browsing Tools
▪ JTAG Forensics
▪ Chip-off Forensics
o Chip-off Forensics Process
o Chip-off Forensic Equipment
▪ Flasher Boxes

15.9. Discuss Mobile Forensics Challenges and Prepare Investigation Report

▪ Challenges in Mobile Forensics
▪ Generate Investigation Report
▪ Mobile Forensics Report Template
▪ Sample Mobile Forensic Analysis Worksheet
▪ Cellebrite UFED Touch Sample Mobile Forensics Report Snapshot

Module 16: IoT Forensics

16.1. Understand IoT and IoT Security Problems

▪ What is IoT?
▪ IoT Architecture
▪ IoT Security Problems
▪ OWASP Top 10 IoT Vulnerabilities
▪ IoT Attack Surface Areas

16.2. Recognize Different Types of IoT Threats

▪ IoT Threats
o DDoS Attack
o Attack on HVAC Systems
o Rolling Code Attack
o BlueBorne Attack
o Jamming Attack
o Hacking Smart Grid/Industrial Devices: Remote Access Using Backdoor
o Other IoT Attacks

16.3. Understand IoT Forensics

▪ Introduction to IoT Forensics
▪ IoT Forensics Process
▪ Case Study: Default Passwords Aid Satori IoT Botnet Attacks
▪ IoT Forensics Challenges

16.4. Perform Forensics on IoT Devices

▪ Wearable IoT Device: Smartwatch
o Wearable IoT Device Forensics: Smartwatch
o Steps Involved in Data Acquisition and Analysis of Android Wear
o Logical Acquisition of Android Wear
o Physical Acquisition of Android Wear
o Forensic Examination of Evidence File: Android Wear
o Recovered Forensic Artifacts: Android Wear
▪ IoT Device Forensics: Smart Speaker—Amazon Echo
o Amazon Alexa Forensics: Client-based Analysis
o Amazon Alexa Forensics: Cloud-based Analysis
o List of Amazon Alexa APIs
▪ Hardware Level Analysis: JTAG and Chip-off Forensics