DFIR

• Understanding the concepts of DFIR and digital forensics
• Tools and techniques used in DFIR investigations
• Importance of forensic readiness

• Understanding NTFS file systems and their structures
• Data acquisition techniques and best practices
• Image creation and analysis

• Analysis of Windows artifacts and registry keys
• Analysis of Jump Lists, LNK files, and shellbags
• Analysis of Windows Event Logs
• Malware analysis with Redline

• Analysis of macOS artifacts and plists
• Analysis of iOS artifacts and plists
• Use of iLEAPP for mobile device analysis

• Use of Wireshark for network traffic analysis
• Understanding email header analysis
• Analysis of RDP hashes and payload distribution formats

• Use of Redline and Volatility for memory analysis
• Persistence and prefetch analysis
• Use of YARA for malware detection

• Understanding the incident response process
• Use of KAPE, Cyber Triage, and SIFT for incident response
• Threat hunting using Kansa

• Writing forensic reports
• Legal aspects of digital forensics
• Testifying in court

• Use of Plaso for timeline analysis
• Use of WSL 2 for DFIR investigations
• Analysis of SRUM and WMI artifacts
• Use of EventFinder2 and EvtxECmd

• Practical sessions and hands-on exercises
• Real-world case studies and scenarios

By the end of this course, students will have a comprehensive understanding of digital forensics and incident response, and will be equipped with the necessary skills to conduct DFIR investigations. They will also have practical experience with various forensic tools and techniques used in the industry, and will be able to apply this knowledge to real-world scenarios.