10151133Network Forensics and Threat Hunting
Course Information
Description
This course provides a broad overview of computer forensics and investigation tools and techniques. All major personal computer operating system architectures and disk structures will be discussed, as well as what computer forensic hardware and software tools are available. The details of data acquisition, computer forensic analysis, email investigations, image file recovery, investigative report writing, and expert witness requirements. The course provides a range of laboratory and hands-on assignments that teach about theory as well as the practical application of computer forensic investigation. Open Source tools include: The Sleuth Kit, dd, Scalpel, etc.
Total Credits
3
Course Competencies
  1. Explain DD and Helix
    Assessment Strategies
    by completing lab manual assignment
    using a business scenario
    by examination
    Criteria
    lab manual meets guidelines as specified by the instructor
    you enter into class discussions about tools used to mine data and the effectiveness of these tools
    you utilize the dd utility to access data off of a device
    you download a helix distribution and use it to access a system
    you create your own helix cd
    you listen attentively during class

  2. Compare grabbing and hashing
    Assessment Strategies
    by completing lab manual assignment
    using a business scenario
    by examination
    Criteria
    lab manual meets guidelines as specified by the instructor
    you enter into class discussions about grabbing and hashing data
    you utilize forensic utility tools to access hidden or deleted data
    you listen attentively during class

  3. Use Forensic ToolKit (FTK) Imager
    Assessment Strategies
    by completing lab manual assignment
    using a business scenario
    by examination
    Criteria
    lab manual meets guidelines as specified by the instructor
    you enter into class discussions about advanced tools that allow you to access data in FAT, NTFS, EXT 2 and 3 as well as HFS and HPFS file systems
    you utilize FTK to acquire locked system files
    you utilize FTK to hash physically or logically for verification
    you listen attentively during class

  4. Explain chain of custody
    Assessment Strategies
    by completing lab manual assignment
    using a business scenario
    by examination
    Criteria
    lab manual meets guidelines as specified by the instructor
    you enter into class discussions about law and it's relationship with forensic data
    you enter into class discussions about preserving computer data as evidence
    you enter into class discussions about acting as an expert witness in a case on computer data
    you listen attentively during class

  5. Compare file headers and type mismatches
    Assessment Strategies
    by completing lab manual assignment
    using a business scenario
    by examination
    Criteria
    lab manual meets guidelines as specified by the instructor
    you enter into class discussions about matching headers and file types
    you determine when data has mismatched headers and file types
    you listen attentively during class

  6. Utilize autopsy to mine data
    Assessment Strategies
    by completing lab manual assignment
    using a business scenario
    by examination
    Criteria
    lab manual meets guidelines as specified by the instructor
    you enter into class discussions about open source digital investigation tools
    you utilize open source digital investigation tools to to analyze NTFS, FAT, Ext2, Ext3, UFS1, and UFS2 file systems and several volume system types
    you listen attentively during class

  7. Use PyFlag to mine data
    Assessment Strategies
    by completing lab manual assignment
    using a business scenario
    by examination
    Criteria
    lab manual meets guidelines as specified by the instructor
    you enter into class discussions about log file analysis in forensic investigations
    you configure and utilize pyflag to analyze log files
    you listen attentively during class

  8. Explain data chunking
    Assessment Strategies
    by completing lab manual assignment
    using a business scenario
    by examination
    Criteria
    lab manual meets guidelines as specified by the instructor
    you enter into class discussions about managing large files of data
    you utilize data mining tools to access chunks of data on a RAID array
    you listen attentively during class