-: In this section of the course, we're going to play detective 2 2
and start our coverage of digital forensics. 3 3
Now, this is an area that I really love 4 4
inside the cybersecurity world, having spent several years 5 5
as a digital media collector 6 6
and digital forensic examiner myself. 7 7
Now, in this section of the course 8 8
we're going to be focused on domain one, security operations 9 9
and domain three, instant response management 10 10
with a focus on objectives 1.3 and 3.2. 11 11
Objective 1.3 states that given a scenario, 12 12
you must be able to use appropriate tools 13 13
or techniques to determine malicious activity. 14 14
In our case, we are specifically going to be looking 15 15
at file analysis inside digital forensics 16 16
and our use of hashing to verify the integrity 17 17
of our evidence along with using hashes 18 18
as an indicator or compromise on a given system. 19 19
Objective 3.2 states that given a scenario, 20 20
you must be able to perform instant response activities. 21 21
Here, we're really going to be focused on the detection 22 22
and analysis phase, including the determination 23 23
of indicators or compromise, collection of evidence 24 24
and the concepts surrounding the chain 25 25
of custody of that evidence. 26 26
As we begin this section, it's going to be important 27 27
to realize that we're going to be focused on 28 28
digital forensic techniques 29 29
for workstations, desktops, laptops, and servers 30 30
in this section of the course. 31 31
Now, in a later section of the course, we're going to return 32 32
to forensics and look at how they're used specifically 33 33
for virtualized systems, mobile devices, and the cloud too. 34 34
As we move through this section of the course though, 35 35
we're going to be starting out with a look 36 36
at the role of a digital forensic analyst 37 37
inside of the cybersecurity field. 38 38
Then we're going to be discussing the different 39 39
forensic procedures that are used 40 40
by the cybersecurity analyst in their daily jobs. 41 41
Next, we're going to take a look at the concepts 42 42
of work product retention, which is basically saying 43 43
how long are we going to keep that evidence 44 44
and what kind of evidence are we going to keep. 45 45
After that, we're going to be moving into data acquisition 46 46
for later forensic analysis, and we'll be describing some 47 47
of the most common forensic tools that are used 48 48
by analysts out in the field. 49 49
Then we're going to be discussing how system memory images 50 50
and disc images are going to be acquired 51 51
by those forensic analysts out in the field 52 52
because there are different procedures used for each 53 53
of these types of collections that we're going to do. 54 54
Next, we're going to discuss how we maintain the integrity 55 55
of the evidence that's being collected 56 56
by using hashing of forensic images that have been acquired 57 57
by those forensic analysts. 58 58
After that, we're going to need to discuss how 59 59
we can generate a timeline in order for us to analyze data 60 60
across all the forensic evidence that we've been acquiring 61 61
from all of our different devices 62 62
and systems and networks during our forensic collection. 63 63
Sometimes though this evidence isn't collected cleanly. 64 64
For example, a criminal may be trying to delete files 65 65
or scramble the contents of their hard drive 66 66
in order to hide those contents 67 67
from an analyst who's looking at that hard drive. 68 68
But that's okay 69 69
because we have ways to uncover that data too. 70 70
And we're also going to be covering how an analyst 71 71
can overcome this issue by using things like data carving, 72 72
be able to recover these thought to be deleted files 73 73
from a given hard drive and bring them back to life. 74 74
Then we're going to be discussing the legal concept 75 75
known as a chain of custody 76 76
and I'm going to demonstrate how an analyst can collect 77 77
and validate digital evidence 78 78
in a step-by-step video demonstration for you. 79 79
And finally, we're going to take a short quiz 80 80
to see what you learned during this section of the course 81 81
and review each of those quiz questions fully 82 82
to ensure you can explain 83 83
why the right answers were correct. 84 84
So let's jump into the world 85 85
of digital forensics in this section of the course.