Computer Forensics Training:

Getting the Right Knowledge to the Right People at the Right Time. Anywhere. With Client Site Training, courses can be scheduled on a date that is convenient for you, and because they can be scheduled at your location, you don't incur travel costs and students won't be away from home. An additional advantage is that the class is taught on your equipment, so students are learning in their work environment rather than in a classroom setup. Integrating ways of dealing with computer attacks and crimes barely requires any justification these days given how pervasive such assaults are. Because security is a fairly new necessity for companies, this course focuses mainly on how to prevent attacks and minimize any damages that occur. In today’s world, attacks are inevitable, and it’s wise to be prepared. Hackers will do their best to cover their tracks after they have compromised systems and possibly load dangerous tools, backdoors, or logic bombs. Uncovering these activities and gathering evidence for possible prosecution requires specialized skills that most people do not possess. This course teaches your students these skills and techniques. Even if they are not interested in prosecuting these individuals, it is critical that they understand how to track a hacker’s steps in order to reduce the damage wrought by an attack. To properly gather this type of data can take even the most qualified security professionals a great deal of time, reducing the strategy’s overall effectiveness. This course teaches students how to create an in-house incident response program and team. Your students will learn the necessary architecture to put in place, including the tools and technologies required to uncover a wide range of malicious activities. These steps will help save a company money, time, and possibly its reputation, by decreasing the recovery time after an attack. A combination of lectures, demonstrations, and extensive hands-on labs during the course allow your students to carry out the same activities in their own environment.

Who Should Attend

The Data Forensics course is designed for people with at least two-years’ experience working closely with information systems. This is an advanced security course, so students need to have a good understanding of TCP/IP, Linux, Unix, and Windows operating systems and commands.

Course Aim:

The Computer Forensics course teaches your students how to identify the common, and not so common, strategies of attackers. This includes identifying and handling logic bombs, back doors, rootkits, and malicious code. Your students will also learn the necessary steps of incident handling: preparation, identification, containment, eradication, and recovery. They will be taught how to uncover even the most advanced hacker techniques that bypass firewalls and IDSs. This course covers Windows, Unix, and Linux forensics procedures, and methods of recovering data for analysis. It is important to know how to properly interact with law enforcement agencies during investigations and the laws that define how these processes should be carried out. Over 1,000 pages containing the following items: * 10 modules covering computer forensics tools, methodologies, and countermeasures * Each and every slide the instructor will present in-class * Professionally developed graphics for conceptual understanding * Underneath each slide there is 4-5 paragraphs explaining concepts in slides, Configuration Steps, Hints, Warnings, Tips, Tables, etc. * Each module has a Quick Tips section, Summary section, Terminology section, and 20 question and answers * Each module is filled with robust and comprehensive labs * Hardware, software, and configurations requirements necessary for the classroom environment * Each product has a final practice exam of 200+ questions * in addition to those included in student manual * A security professional hacking and penetration testing review sheet Upon class completion, students will have been provided background and participated in discussions related to hackers and their strategies to carrying out different types of computer crimes. The real-world scenarios and labs provided will have equipped the students to carry out forensics tasks in their environment. The students will be able to aid their company in protecting itself against potential crimes, but also help the company after such unfortunate events have taken place.

Topics Covered

Day 1 - Fundamentals of Forensics and Investigation The fundamental principles of the forensics discipline are taught this day. These must be understood before gathering evidence or carrying out an investigation. Various elements of the forensics toolkit will be explored, as well as how to search for clues that prove a crime indeed took place. This day covers the following: * Where incident response and forensics fit within a business model * Where incident response and forensics fit within a security model * Laws pertaining to computer intrusion * Toolkits * Verifying and validating incidents * Responding appropriately to incidents * Reviewing evidence without damaging it The Fundamentals of Forensics and Investigation Lab: In this lab, students work with tools covered in the lecture, many of which require compiling and proper configuration. Some or all of the following are covered: * Protocol analyzer configurations * Compiling TASK, Autopsy, and TCT * Configuring the different tools for specific results * Testing each configuration Day 2 - Legal Issues and Best Practices Individuals and companies that wish to carry out any type of forensics activities must have a clear understanding of the legal issues that surround this topic. One must know the law in order to work within its boundaries. On this day of the course, your students learn about the different laws that apply to forensics, how to abide by them, and how to ensure that any evidence your students collect is admissible in court. Law enforcement agencies associated with this field will be discussed, as well as their jurisdictions and restrictions. This day covers the following: * Legal allowances and restrictions in investigations * Carrying out real-time monitoring for data collection * Working with partners and service providers * The good and bad of dealing with law enforcement * Evidence collection processes for court * International laws and issues Day 3 - Principles of Forensics Work This day explores the tools and steps used to construct images of systems that are suspected of being attacked. A quick primer of the file system is followed by an explanation of the different tools in a professional’s arsenal. Your students then apply these lessons by investigating a sample incident in a hands-on lab. This day covers the following: * More forensic tools * Evidence collection and protection * Analysis of file systems for hidden evidence * File system forensics * The collection of evidence from network sources * Auditing tools and processes * Reconstructing the crime The Principles of Forensics Work Lab This lab allows your students to dive into the practices of a forensics professional, used when they first arrive at a crime scene. Your students will work with new tools and carry out evidence identification and recovery processes. Some or all of the following are covered: * Working with common Unix and Linux commands * Creating a bit image * Ensuring the integrity of the image * Reviewing log files for clues and hidden files * Carrying out forensics work on a Linux image Day 4 - The Forensics Toolkit As with other security disciplines there are specific industry-standard tools that must be understood and used properly to meet the necessary goals. During this day, your students learn about the tools most often employed by forensics specialists: The At-Stake Sleuth Kit (TASK) and The Coroner’s Toolkit (TCT). The instructor then walks the class through the manual and automated processes of evidence collection. This day covers the following: * Capturing forensics data with different tools * File system analysis and manipulation tools * Retrieving deleted files * Reconstructing the crime and timeline The Forensics Toolkit Lab This lab allows your students to work with industry standard tools and carry out evidence collection activities. Some or all of the following are covered: * Using Grave-Robber for data collection * Using ILS and ICAT and laxarus * Working with TASK * Creating timelines of the crime Day 5 - Forensics in a Windows Environment Wireless is a hot, involving technology that is riddled with vulnerabilities. For this day’s lectures, the different 802.11 standards are explained along with both the core deficiencies of the standard and the many ways those vulnerabilities are exploited. This day will cover the many wireless issues and attacks: * 802.11 standards * WEP * Finding WLANs * Cracking WEP keys * Sniffing traffic * Wireless DoS attacks * WLAN scanners * WLAN sniffers * MAC sniffing * Access point spoofing * Securing wireless networks * Hacking Tool: NetTumbler * Hacking Tool: AirSnort * Hacking Tool: AiroPeek * Hacking Tool: WEP Cracker * Hacking Tool: Kismet The Wireless Lab This lab allows your students to carry out wireless sniffing and access point attacks so your students can understand the different tools and techniques in use today. Your students will learn how access points are identified and how access points can be easily detected. The Wireless Lab will cover some or all of the following items: * Finding WLANs * Cracking WEP keys * Sniffing traffic * Wireless DoS attacks * WLAN scanners * WLAN sniffers * MAC sniffing * Access point spoofing * Securing wireless networks * Hacking Tool: NetTumbler * Hacking Tool: AirSnort * Hacking Tool: AiroPeek * Hacking Tool: WEP Cracker * Hacking Tool: Kismet Day 6 - Advanced Topics and Challenges During this day your students learn how to dissect and examine malicious software that has been planted during a system compromise. Other tools that allow your students to collect hidden evidence within the system are also discussed. Lastly, your students learn about the different ways wiretapping and real-time data collection can take place. The Advanced Topics and Challenges Lab In this lab, your students work through a full real-world scenario, uncovering the steps of a crime and its resulting evidence. Using a compromised system, your students carry out many of the techniques learned in the previous days.

For organizational purchases, please send us a message at salesinfo@enogroups.com or complete and submit this form.