Course Methodology

The course includes practical sessions, videos as well as live demonstrations and live coding.  A hands-on use of all tools is encouraged throughout the course as all participants engage in the real-time investigation of a test case. 

Course Objectives

By the end of the course, participants will be able to:

• Apply a Digital Forensics methodology in an operational environment
• Set a strategy for a Digital Forensics response framework
• Conduct investigations into social media, malware, viruses, and ransomware
• Manage a Digital Scene-of-Crime and its Digital evidence and artifacts
• Investigate mobile technologies, and other media which may hold evidential materials and artifacts
• Apply the techniques to extract images from systems artifacts

Target Audience

This course is designed for IT professionals, Fraud Investigators, Auditors, CSIRT and SOC Analysts, working in companies that are targets for cyber and digital attacks. It is also highly beneficial for police and military personnel, probation officers and other security personnel who deal with cyber investigations. 

Target Competencies

• Performing incident response
• Understanding digital forensics
• Conducting digital crime investigation
• Applying forensic science

Digital forensics – background and legal practices

• Introduction to the science of forensics
• Terms and definitions
• Chain of digital crime
• The background of digital crime
• Case histories of real-life cases
• Digital forensics - law
• Digital forensics - legislation
• Standards of digital forensics
• Fundamentals of digital forensics
• The risks faced by organizations

The digital forensics response framework

• The first responder digital forensics toolkit
• Scene of digital crime management
• The Secure Operations Centre (SOC)
• The CSIRT (Computer Security Incident Response Team)
• Roles and responsibilities
• Implementing a framework 
• Case management

Collecting and processing digital evidence

• Domain Name System (DNS)
• Extended security infrastructures
• Investigating mobile technologies
• Acquisition of digital evidence and artifacts
• Handling of digital evidence and artifacts
• Processing of digital evidence and artifacts
• Case management protocols
• Wireless protocols
• Supporting technologies
• Reporting practices

Investigations of internal and external digital crimes

• OSINT (Open Source Intelligence)
• Its place in the digital forensic investigation
• Defining internal crimes 
• Defining external crimes
• Child exploitation and investigations
• Malicious applications
• Ransomware
• Anti-forensics capabilities
• Digital forensics and terrorism