Master Windows Forensics : What Do You Want to Uncover Today?
Every organization will deal with cyber-crime occurring on the latest Windows operating systems. Analysts will investigate crimes including fraud, insider threats, industrial espionage, traditional crimes, and computer hacking. Government agencies use media exploitation of Windows systems to recover key intelligence available on adversary systems. To help solve these cases, organizations are hiring digital forensic professionals, investigators, and agents to uncover what happened on a system.
FOR408: Windows Forensic Analysis focuses on a comprehensive and deep analysis of the latest Microsoft Windows operating systems. In this intermediate course, you will learn directly how forensic analysts track the second-by-second trail left behind by evildoers used in successful criminal prosecution, incident response, media exploitation or civil litigation.
Proper analysis requires real data for students to examine. The completely updated FOR408 course trains digital forensic analysts through a series of new hands-on laboratory exercises that incorporate evidence found on the latest Microsoft technologies (Windows 8.1, Office365, Skydrive, Sharepoint, Exchange Online, and Windows Phone). This will ensure that students are prepared to investigate the latest trends and capabilities they might encounter. In addition, students will have labs that cover both Windows XP and Windows 7 artifacts.
Updated FOR408 Course in 2014: This course utilizes a brand-new Windows 8.1 based case exercise that took over 6 months to create the data. Realistic example case data takes months to create in real time correctly. The example case is a Windows 8.1 based image that has the subject utilize Windows Phone, Office 365, Sharepoint, MS Portal Online, Skydrive/Onedrive, Dropbox, and USB external devices. Our development team spent months creating an incredibly realistic scenario. The case demonstrates the latest technologies an investigator would encounter analyzing a Windows operating system. The brand new case workbook, will detail the step-by-step each investigator could follow to examine the latest technologies including Windows 8.1.
Focus: Modern techniques in digital forensics on Windows systems. Triage-based acquisition techniques. Stream- and file-based extraction techniques. Evidence mounting and examination.
FOCUS: Windows XP, Windows 7, and Windows 8/8.1 Registry Analysis and USB Device Forensics.
Focus: You will learn how major forensic suites can facilitate and expedite the investigative process, and how to recover and analyze e-mail, the most popular form of communication. Client-based, server-based, mobile, and web-based e-mail forensic analysis are discussed in-depth.
Focus: Suspects unknowingly create hundreds of files that link back to their actions on a system. You will learn how to examine key files such as shortcut (LNK) files, Windows prefetch, pagefile/system memory, and more. The latter part of the section centers on examining Windows event log files, demonstrating their usefulness in both simple and complex cases.
Windows log file analysis has solved more cases than possibly any other type of analysis. Understanding the locations and content of these files is crucial to the success of any type of investigator. Many investigators overlook these files because they do not have adequate knowledge or tools to get the job done. The last part of the section will arm each investigator with the core knowledge and capability to maintain this crucial skill for many years to come.
Focus: This section looks at Internet Explorer, Firefox, and Chrome Web Browser digital forensics. You will learn how to examine exactly what individuals did while surfing via their Web browser. The results may give you pause the next time you use the Web!
Focus: This section revolves around a Digital Forensic Challenge based on Windows Vista/7. It is a capstone exercise for every artifact discussed in the class. You will use this section to consolidate the skills that you have learned over the past week.
Please download and install VMware Workstation 10, VMware Fusion 6.0, or VMware Player 6.0 or higher versions on your system prior to class beginning. If you do not own a licensed copy of VMware Workstation or Fusion, you can download a free 30-day trial copy from VMware. VMware will send you a time-limited serial number if you register for the trial at their Web site.
Information technology professionals who want to learn the in-depth concepts of Windows digital forensics investigations.
Incident response team members who need to use deep-dive digital forensics to help solve their Windows hacking cases.
FOR408 is a follow-on class for those who have a foundation in and understanding of the digital forensics process and evidence acquisition. FOR408 is an intermediate course that skips over the introductory material of digital forensics. The class is good for those who are new to forensics or advanced analysts, but who do not want to spend a day on basic and core digital forensic concepts and techniques. We move quickly into the analysis of Windows and spend most of our time analyzing Windows artifacts in the class.
Use free browser forensic tools to perform detailed Web browser analysis, parse raw SQLite and ESE databases, and leverage session recovery artifacts and flash cookies to identify the Web activity of suspects, even if privacy cleaners and in-private browsing are used.
After 27 years in law enforcement, three capabilities immediately rise to the top of my list when I think of what makes a great digital forensic analyst: superior technical skill, sound investigative methodology, and the ability to overcome obstacles. SANS FOR408: Windows Forensic Analysiswas designed to impart these critical skills to the students. Unlike many other training courses that focus on teaching a single tool, FOR408 provides training on many tools. While there are some exceptional tools available, we feel that all forensic analysts need a variety of tools in their arsenal to be able to pick and choose the best tool for each task. However, we also understand that forensic analysts are not great because of the tool(s) they use, but because they artfully apply the right investigative methodology to each analysis. A carpenter can be a master with all his tools and still not know how to build a house. FOR408 teaches students to apply digital forensic methodologies to a variety of case types and situations, allowing them to apply in the real world the right methodology to achieve the best outcome. Finally, the course teaches and demonstrates the problem-solving skills necessary to be a truly successful forensic analyst. Almost immediately after starting your forensic career, you will learn that each forensic analysis presents its own unique challenges. A technique that worked flawlessly for previous examinations may not work for the next one. A good forensic analyst must be able to overcome obstacles through advanced troubleshooting and problem-solving. FOR408 gives students the foundation to solve future problems, overcome obstacles, and become great forensic analysts. No matter if you are new to the forensic community or have been doing forensics for years, FOR408 is a must-have course.
Digital forensics has never been more in demand than it is today. Zettabytes of data are created yearly, and forensic examiners will increasingly be called in to separate the wheat from the chaff. For better or worse, digital artifacts are recorded for almost every action, and the bar has been raised for investigators working to repel computer intrusions, stop intellectual property theft, and put bad actors in jail. We wrote this course as the forensics training we wish would have been available early in our careers. Keeping up with the cutting edge of forensics is daunting, but with frequent updates, I am confident this course provides the most up-to-date training available, whether you are just starting out or are looking to add new skills to your forensic arsenal.