Course Objectives

This four-day course is tailored for investigators and examiners new to digital forensics, providing essential knowledge to effectively comprehend and investigate incidents involving electronic devices. Participants will delve into the architecture and functionality of the FAT File System, focusing on the associated metadata of stored objects on physical media. The program offers an in-depth exploration of partitioning structures, disk layouts, and the implications of formatting volumes that contain pre-existing data.

Additionally, the course thoroughly examines file management and directory structure characteristics, alongside techniques for uncovering potential evidence critical to successful examinations. Topics of interest will include file headers, file hashing, recovery of deleted files, and the basic analysis of Windows-based systems. To enhance learning, the course integrates an investigative scenario, allowing participants to gain hands-on experience in the examination of collected evidence. By the end of this program, attendees will be equipped with foundational skills and insights necessary for navigating the complexities of digital forensics, ensuring they are prepared to tackle real-world challenges in the field.

.

Primary Learning Objectives

Day 1 of the Spyder Forensics Foundations in Digital Forensics course begins with an overview of the course along with an introduction to the Instructor.

Once the intriductions are over we will look the basics of forensic examinations methodology and include a discussion on to triage evidence and creating workflow plans and timeline analysis.

As a first responder your role is vital in the collection of data and we will look at situations that allow you to transport devices securely to an established evidence storage location where forensic imaging can be completed.

This is not always advisable so we will also look at scenarios where a more experienced examiner may be called upon to conduct on-site imaging and acquisition of memory.

During Day 2 we will discuss why seizure and preservation of digital equipment and evidence is the most important aspect of a forensic investigation and take a look at the industry recognized practices involved in this.

We will then move onto an examination of the MBR (Master Boot Record) alog with other things and understand how putting these all together is essential if we want to build a strong foundation in computer forensics.

Day 3 of the Foundations in Digital Forensics course looks at what is considered the most simplistic of the files systems supported by Windows FAT, but even though it is considered simplistic it is aslo something that has to be considered during any digital forensic investigation and we will look at Formatting, Saving and deleting FAT volumes.

We will then look at the hostory of the Microsoft NT family of Operating Systems and investigate the various artifacts associated with each sysem.

The final day of the course sees us looking at the Windows Registry and will drfine key navigation terms and also investigate why the Registry is of great benefit to the examiner is a digital forensic investigation.

Concluding the course will involve us delving into Windows Link Files and the many artifacts left behind by user interaction.