508.1 – Forensic and Investigative Essentials

Intro to forensics – P19-21

Evidence – P22-23

Dirty Word List – P24

Disk Image – P25

Forensic principles – P26

Volatile Evidence – P28

Methodologies – P31-32

Summary – P32

Methodology in depth – P33-40

File system essentials – P45-73

Numbers – P47-48

Little/Big Endian – P49

5 Layers – P51

File System Layer - P52-59

DOS-based partitions – P53-55

MBR – P56-57

Common types of partitions – P58

Data Layer – P61-65

Data Storage and Allocation – P61-62

Contiguous disk space – P63

Slack space – P64

Metadata layer – P66-71

File name layer – P72

Linux EXT2, EXT3 – P74-87

Superblock – P75-76

Blocks – P77-78

Permissions – P79

File Types – P80

Time Stamps – P81

Inodes – P82

Data Pointers – P83

Directories – P84

Deletion (All layers)– P85-86

Windows File System – P88-126

Evolution – P89

FAT – P90-108

Boot Sector – P95-97

Directory Entry – P98-101

Timestamps – P99

Content Data – P102

Cluster Chain – P103

Deletion – P107

NTFS – P109-126

Boot Sector – P111-112

Clusters – P113-114

MFT (Meta.) – P115-117

Timestamps – P118

MFT Layout – P119

Deletion – P121

508.2 -508.3 Forensic Methodology Illustrated

Netcat – P23-24

Win32dd.exe - P27

Memparser –P28

Volitility – P29-30

Memdump – P31-33

Lsof – P35

Reconnaissance – P37

Md5sum – P40

Imaging –P44-68

File formats – P47-50

Dd – P56-65

HPA – P66-68

Chain of Custody – P69

Mmls – P71-75

Mount – P76-82

Timelines – P92-109

Create – P104-106

Fls – P107

Mactime – P111

File command – P122

Srch_string – P123-124

Grep – P125-126

Dirty Words – P127-129

Volatile Evidence Collection – P55

Adepto/Grab – P99-101

Hex editors – P108

TSK – P132-230

Programs – P134-136

Fsstat – P138-148

blkstat – P150

blkcat – P151-153

blkls – P154-157

Slackspace – P157-158

blkcalc – P159-160

sigfind – P162

Foremost – P166-173

Foremost for Windows – P175

ifind – P178-179

istat – P180-186

icat – P187-189

fls – P192-196

ffind – P197-199

TSK Exercises – P202-208

Sorter – P211-218

Hash Databases – P220-222

Md5deep – P223

Hfind – P224

Autopsy – P232-275

Step-by-step – P273-274

Network forensics – P279

508.4 Windows and NTFS Filesystem Forensics

Windows response and collection – P11-35

Cmd – P12-14

Cmdenv.bat – P14

Psexec – P15-16

Nc.exe – P17

WFT – P20-35

Live evidence collection – P25-31

Psinfo – P26-29

Fport – P30-31

Password Discovery – P32-35

Windows media & artifact analysis– P38-104

AV – P40

Registry – P41-61

HIVES – P42-43

NTUDER.DAT – P49-

Sam_parse.exe – P47-48

Search History – P50

Typed URLs – P51

Last commands – P52

Last files saved – P53

UserAssist – P54-57

Regripper.pl – P58-59

Regtime.exe – P60

Restore Points (XP) – P63-68

Sr.exe – P64

Changelog – P66

Rp.log – P67

Shadow (Vista) – P69-76

Vssadmin – P72

Mklink – P73

Imaging – P74-75

Prefetch/Superfetch – P77-80

Pref.pl – P79-80

Email forensics – P81-83

Shortcut (lnk) – P84-87

Lslnk.exe – P84

Word forensics – P88-91

Wmd.pl – P90-91

Thumbs.db – P92-97

Vinetto – P94

Thumbcache – P96-97

Exif – P98

Internet history (pasco) – P100

Recycle bin – P101-??

INFO2 – P103-107

Rifiuti – P104

Windows network forensics – P117-129

WFT Config file – P131

508.5 Computer Investigative Law for Forensic Analysts

Who can investigate – P3-60

Internal General – P3-4

Incident Response Policy – P5

Internal– P6-12

Outsource – P13-14

Law Enforcement – Criminal Conduct – P15-31

Common Cyber-defenses – P32-33

International aspects – P34-39

Whether to report – P40-54

Whom to Call? – P55-57

What is expected? – P58-60

Acquiring Data – P61-98

Goals – P61

Authority – P62-64

Stand alone devices – P65-66

Network and Real Time – P67-70

ECPA – P71-76

Real-Time – P77

Provider Exception – P78-79

Consent Exception – P80

Trespasser Exception – P81-82

Header information – P83-84

Lawful Access – P85-86

EU Data Retention – P87

HIPAA – P88-89

SOX – P90

GLB – P91

FERPA – P92

Other Data – P93

EU data Protection – P94-96

Outside Recon – P97

Tools – P98

Post Collection – Preservation – P99-101

Data analysis & report – P102-104

Report Writing – P105-108

Rules of Evidence – P109-113

Honeypots – P115-126

European Law – P127-128

European Version – P2-1

508.6 Advanced Forensics

Application footprinting – P4-31

Tools – P5

Active Reg monitor – P6

Step by step – P8-14

Results – P15-16

USB Reg keys – P17-19

Timeline analysis – P20

USB and setupapilog – P21-22

Firefox off USB key – P23-25

Digital file shred pro – P26-27

Unplugged – P29-30

Conclusion – P31

Fuzzy hashing – P32-37

Ssdeep – P34-37

Malware Footprinting – P114-159