Duration: 5 days – 35 hrs
Overview
The Digital Forensics and Incident Response (DFIR) Training Course is designed to equip participants with the essential knowledge and skills needed to effectively handle and investigate digital incidents. This comprehensive training program covers the key concepts, methodologies, and tools required to conduct digital forensics and respond to cybersecurity incidents in a structured and efficient manner.
Objectives
- This program is designed to train professionals on incident response and digital forensics. This course cover various types of incidents, attack detection methods and reporting, evidence acquisition and analysis, system analysis, hard disk and memory analysis, network analysis and application analysis.
- This shall enable the participants to understand technological weaknesses and the offensive techniques used by intruders, how to conduct root cause analysis(RCA) and adapt proven digital forensic procedures.
Audience
- Practice Heads
- Project Leads
- System Engineering Teams
- Testing Teams
- Security Analysts
- Forensic Analysts
- Security Enthusiasts
- Cybersecurity analysts and professionals
- Digital forensic investigators
- Incident response team members
- Law enforcement personnel
- IT administrators and system administrators
- Network security engineers
- IT auditors and compliance professionals
Prerequisites
- Fundamentals of Cyber Security
- Basic knowledge and understanding computer system architecture
- Basic knowledge OSI & TCP/IP model
- Basic knowledge Web application architecture
- Basic knowledge Web server architecture
- Basic knowledge DNS, DHCP, SMTP, SNMP and other protocols
- Basic knowledge HTTP and HTTPS
- Participants are expected to have a basic understanding of cybersecurity concepts, computer networks, and operating systems. Familiarity with fundamental concepts of digital forensics and incident response will be beneficial, but not mandatory.
Course Content
Introduction to Digital Forensics (DF)
Cyber Space Evolution
- System, Network and Application Architecture
- Types of Computer Crimes
Digital forensics
- History and Its importance
- Job of Forensics Specialist & Investigator
- Types of Digital Forensic Investigation
- Types of investigation phases
- Scoping and Identification evidences
- Application of digital forensics
- Law Enforcement, Human Resources and others
- Relationship to Intrusion Detection, Firewalls and honeypots in DF
Introduction to Incident Response (IR)
- What are Incident Response and its stages
- Overview of Incident Response Plan
- Management role in Incident Response
- Identification and Classification of incident
- IR – Intelligence Gathering
- Role of First Responder
- NIST & SANS in DFIR
Incident Handling and Response Process
- Steps of Incident Response
- Preparation
- Identification
- Containment
- Investigation
- Eradication
- Recovery
- Follow-Up
- Data breach (Theft of information) – How to investigate incident and report.
- Endpoint incident analysis – Responding to a client system or internal source-identifying unusual system behavior.
- Malware Outbreak – Virus, Trojan, Backdoor and Ransomware.
- Rogue Endpoints / Servers – The unauthorized use of a system for the processing or storage of data.
- Incident Report Preparation.
Forensic Readiness and First Response
- Overview of Forensic Readiness
- Overview of Digital Evidence
- Understanding the Principles of Digital Evidence Collection
Overview of Data Acquisition
- Types of Evidence : Static and Volatile
- Understanding the Static Evidence Collection
- Understanding the Volatile Evidence Collection
- Types of Acquisition.
- Collection of the Evidence
- Securing the Evidence
Examination and Analysis Techniques
- Rules of evidence
- Chain of Custody
- Search Techniques
- Reconstruction of Events
- Time based analysis
- Cracking Passwords
- File Systems forensics
- Memory Forensics
- Disk Image Forensics
- Document Analysis and Steganography
- Common Windows Artifacts
- Windows & Linux Forensics
- Network Traffic Analysis & Forensics
- Web Attack Forensics
- Malware Analysis
- Overview of Anti-Forensics
- Anti- Forensic Tools and Usage
- Digital Forensics Report Preparation
