Learning Cyber Incident Response and Digital Forensics
                                    
                                        Overview
                                            
                                                ()
                                            
                                            
                                    
                                    
                                        Getting started
                                            
                                                ()
                                            
                                            
                                    
                             
                            
                                1. Fundamentals of Digital Forensics
                                    
                                        Digital forensics
                                            
                                                ()
                                            
                                            
                                    
                                    
                                        What is cybercrime?
                                            
                                                ()
                                            
                                            
                                    
                                    
                                        Digital forensics investigations
                                            
                                                ()
                                            
                                            
                                    
                                    
                                        Types of evidence
                                            
                                                ()
                                            
                                            
                                    
                                    
                                        Best practices
                                            
                                                ()
                                            
                                            
                                    
                                    
                                        Review of the chapter quiz
                                            
                                                ()
                                            
                                            
                                    
                             
                            
                                2. Selecting Forensic Tools
                                    
                                        Selecting forensic tools
                                            
                                                ()
                                            
                                            
                                    
                                    
                                        Types of forensic tools
                                            
                                                ()
                                            
                                            
                                    
                                    
                                        Commercial vs. open-source forensic tools
                                            
                                                ()
                                            
                                            
                                    
                                    
                                        Legal considerations
                                            
                                                ()
                                            
                                            
                                    
                                    
                                        Building a forensic toolkit
                                            
                                                ()
                                            
                                            
                                    
                                    
                                        Review of the chapter quiz
                                            
                                                ()
                                            
                                            
                                    
                             
                            
                                3. Digital Forensic Investigation
                                    
                                        Digital forensic investigation
                                            
                                                ()
                                            
                                            
                                    
                                    
                                        Preserving evidence
                                            
                                                ()
                                            
                                            
                                    
                                    
                                        Preparing an evidence drive
                                            
                                                ()
                                            
                                            
                                    
                                    
                                        Creating a trusted tools USB drive
                                            
                                                ()
                                            
                                            
                                    
                                    
                                        Collecting volatile evidence
                                            
                                                ()
                                            
                                            
                                    
                                    
                                        Collecting network evidence
                                            
                                                ()
                                            
                                            
                                    
                                    
                                        Imaging storage devices with FTK
                                            
                                                ()
                                            
                                            
                                    
                                    
                                        Imaging a USB drive with DD
                                            
                                                ()
                                            
                                            
                                    
                                    
                                        Review of the chapter quiz
                                            
                                                ()
                                            
                                            
                                    
                             
                            
                                4. Conducting Forensic Analysis
                                    
                                        Conducting forensic analysis
                                            
                                                ()
                                            
                                            
                                    
                                    
                                        Analyzing memory contents
                                            
                                                ()
                                            
                                            
                                    
                                    
                                        Importing evidence into Autopsy
                                            
                                                ()
                                            
                                            
                                    
                                    
                                        Analyzing hidden and deleted files
                                            
                                                ()
                                            
                                            
                                    
                                    
                                        Analyzing the windows registry
                                            
                                                ()
                                            
                                            
                                    
                                    
                                        Conducting log analysis
                                            
                                                ()
                                            
                                            
                                    
                                    
                                        Creating your report
                                            
                                                ()
                                            
                                            
                                    
                                    
                                        Other considerations
                                            
                                                ()
                                            
                                            
                                    
                                    
                                        Review of the chapter quiz
                                            
                                                ()
                                            
                                            
                                    
                             
                            
                                5. Cyber Incident Response
                                    
                                        Cyber incident response
                                            
                                                ()
                                            
                                            
                                    
                                    
                                        Preparation phase
                                            
                                                ()
                                            
                                            
                                    
                                    
                                        Detection and analysis phase
                                            
                                                ()
                                            
                                            
                                    
                                    
                                        Containment, eradication, and recovery phase
                                            
                                                ()
                                            
                                            
                                    
                                    
                                        Post-incident activity phase
                                            
                                                ()
                                            
                                            
                                    
                                    
                                        Review of the chapter quiz
                                            
                                                ()
                                            
                                            
                                    
                             
                            
                                6. Conducting a Cyber Incident Response
                                    
                                        Conducting a cyber incident response
                                            
                                                ()
                                            
                                            
                                    
                                    
                                        Static analysis with floss
                                            
                                                ()
                                            
                                            
                                    
                                    
                                        Dynamic analysis with Autoruns
                                            
                                                ()
                                            
                                            
                                    
                                    
                                        Investigating the scheduled task
                                            
                                                ()
                                            
                                            
                                    
                                    
                                        Packet analysis with Wireshark and process monitoring
                                            
                                                ()
                                            
                                            
                                    
                                    
                                        Files and folders created
                                            
                                                ()
                                            
                                            
                                    
                                    
                                        Static analysis with IDA and OllyDbg
                                            
                                                ()
                                            
                                            
                                    
                                    
                                        Static analysis with process dump
                                            
                                                ()
                                            
                                            
                                    
                                    
                                        Malware IoC research
                                            
                                                ()
                                            
                                            
                                    
                                    
                                        Review of the chapter quiz
                                            
                                                ()
                                            
                                            
                                    
                             
                            
                                Conclusion
                                    
                                        What to do next
                                            
                                                ()
                                            
                                            
                                    
                             
                     
                        
                                
                                    trickster.zip
                                    
                                        (221 KB)
                                    
                                
                                
                                    Ex_Files_Learning_Cyber_Incident_Response_Digital_Forensics.zip
                                    
                                        (2.2 MB)