Computer Forensics Course Catalogue

Transcription

1 Cmputer Frensics Curse Catalgue

2 AccessData Advanced Frensics Intermediate Five-Day Instructr-Led Curse The AccessData Advanced Frensics five-day curse prvides the knwledge and skills necessary t install, cnfigure and effectively use Frensic Tlkit (FTK ), FTK Imager Passwrd Recvery Tlkit (PRTK ) and Registry Viewer. Participants will als use AccessData prducts t cnduct frensic investigatins n Micrsft Windws systems, learning where and hw t lcate Windws system artifacts. Prerequisites This hands-n class is intended fr new users, particularly frensic prfessinals and law enfrcement persnnel, wh use AccessData frensic sftware t examine, analyze, and classify digital evidence. T btain the maximum benefit frm this curse, yu shuld meet the fllwing requirements: Able t understand curse curriculum presented in English Perfrm basic peratins n a persnal cmputer Have a basic knwledge f cmputer frensic investigatins and acquisitin prcedures Be familiar with the Micrsft Windws envirnment Class Materials and Sftware Yu will receive the assciated materials prir t the curse. During this five-day, hands-n curse, participants will perfrm the fllwing tasks: Install and cnfigure FTK, FTK Imager, PRTK, and Registry Viewer Use FTK Imager t preview evidence, exprt evidence files, create frensic images and cnvert existing images Use the Registry Viewer t lcate evidentiary infrmatin in Windws 2K and XP registry files Create a case in FTK Use FTK t prcess and analyze dcuments, metadata, graphics and Use bkmarks and check marks t efficiently manage and prcess case data Update and custmize the KFF database Create and apply file filters t manage evidence in FTK Create regular expressins Imprt search lists fr indexed searches in FTK Use the FTK Data Carving feature t recver files frm unallcated disk space Use custm dictinaries and dictinary prfiles t recver passwrds in PRTK Use a FTK wrd list t create a custm dictinary in PRTK Create a user prfile and bigraphical dictinary in PRTK Add SAM and Syskey values t PRTK t recver passwrds and decrypt encrypted files Recver frensic infrmatin frm Recycle Bin INFO2 files Recver frensic infrmatin frm the fllwing Windws XP artifacts: Thumbs.db files Metadata Link and Spl Files Alternate Data Streams Windws XP Prefetch Recver EFS encrypted files n Windws 2000 and XP systems Create and custmize reprts The class includes multiple hands-n labs that allw students t apply what they have learned in the wrkshp. LAB, Passwrd Recvery Tlkit, PRTK, Registry Viewer, and Ultimate Tlkit are registered trademarks f the (Cntinued AccessData Grup, n ther LLC. side) in the United States and/r ther cuntries. Other trademarks referenced are prperty f their respective wners.

3 AccessData Advanced Frensics Intermediate Five-Day Instructr-Led Curse Mdule 1: Intrductin Tpics: Identify the FTK cmpnents List the FTK and PRTK system requirements Describe hw t receive upgrades and supprt fr AccessData tls Install required applicatins and drivers Participants will install the UTK cmpnents FTK, KFF Library, FTK Imager, Registry Viewer, and PRTK Mdule 2: Wrking with FTK Imager Describe standard data strage devices Identify sme cmmn sftware and hardware acquisitin tls List sme cmmn frensic image frmats Use FTK Imager t perfrm the fllwing functins: Preview evidence Exprt data files Create a hash t benchmark yur case evidence Acquire an image f evidence data Cnvert existing images t ther frmats Use dckable windws in FTK Imager Navigate evidence items Use the prperties and interpreters windws Validate frensic images Create Custm Cntent Images Munt images Capture active RAM During the practical participants acquire an image f a thumb drive, then explre the FTK Imager features and functins discussed in the mdule, including cnverting an image t a different image frmat, creating a Custm Cntent Image, and munting an image. Mdule 3: Windws Registry Windws Registry 101 Describe the functin f the Windws registry Identify the files that make up the Windws registry Describe hw the registry is rganized Identify frensic issues assciated with multiple prfiles n Windws systems Windws 2000 and XP Registries Identify the files that make up the Windws 2000 and XP registry, list their lcatins, and describe the infrmatin they cntain Identify reasns t reslve a user t a SID Identify ntable tracking differences in the registry n FAT and NTFS systems including a lk at tracking munted devices Mdule 4: Registry Viewer Wrking with Registry Viewer Identify the menu and tlbar ptins in Registry Viewer Describe hw Registry Viewer displays MRU lists Describe the functin f the Registry Viewer s cmmn areas Describe different methds t search the registry Create a reprt in Registry Viewer Create a Summary reprt in Registry Viewer Utilize Registry Viewer help Review the Registry Viewer interface Harvest and view registry files LAB, Passwrd Recvery Tlkit, PRTK, Registry Viewer, and Ultimate Tlkit are registered trademarks f the AccessData Grup, LLC. in the United States and/r ther cuntries. Other trademarks referenced are prperty f their respective wners.

4 AccessData Advanced Frensics Intermediate Five-Day Instructr-Led Curse Mdule 5: Wrking with FTK Part 1 Effectively use the Case Manager Create an administer users Back up, delete, and restre cases Identify the evidence prcessing ptins Create a case Identify the basic FTK interface cmpnents, including the menu and tlbar ptins as well as the prgram tabs Obtain basic analysis data During the practical, participants g thrugh the intrductry steps f prcessing a case, including creating a case, adding evidence t the case, and prcessing case evidence. Students will als perfrm basic system functins such as creating user accunts and defining different levels f permissins t a case, managing shared bjects, and custmizing the FTK interface. Mdule 6: Wrking with FTK Part 2 Change time zne display Create and manage bkmarks View cmpund files Exprt files and flders Create custm clumn settings t manage the infrmatin that appears in the FTK file list Use the Cpy Special and Exprt File List Inf features Perfrm additinal analysis, such as full text indexing, after evidence has been added t the case Perfrm autmatic and manual data carving functins The labs in this mdule guide participants thrugh mre advanced functins in prcessing case evidence. During the practical, participants will bkmark evidence, view metadata and cmpund files, examine registry files, recver deleted files frm the Recycle Bin, exprt case files and flders, create custm clumn settings, decrypt files, and use the data carving feature t recver evidence items frm file slack and unallcated space. Mdule 7: Prcessing the Case Identify the elements f a graphics case Navigate the FTK Graphics tab Exprt graphics files and hash sets Tag graphics files using the Bkmarks feature Identify the elements f an case Identify supprted types Navigate the FTK tab Srt Find a wrd r phrase in an message r attachment Exprt items During the practical, participants explre FTK features t view, srt, and exprt and graphic artifacts frm the case. Students will als create custm clumns fr graphics and , exprt and graphics files, and create a hash list. LAB, Passwrd Recvery Tlkit, PRTK, Registry Viewer, and Ultimate Tlkit are registered trademarks f the AccessData Grup, LLC. in the United States and/r ther cuntries. Other trademarks referenced are prperty f their respective wners.

5 AccessData Advanced Frensics Intermediate Five-Day Instructr-Led Curse Mdule 8: Narrwing Yur Fcus Narrw evidence items using the Knwn File Filter, checked items, and filtered/ignred items Perfrm an indexed search Imprt search terms frm text files Perfrm a regular expressin search During the practical, participants learn hw t effectively srt thrugh case evidence t lcate items f interest. Students will use the KFF database t ignre r flag knwn files, perfrm keywrd searches, use dtsearch ptins t custmize a search, and use regular expressins t search case evidence fr pattern data such as credit card numbers r IP addresses. Mdule 9: Regular Expressins Understand basic Operatrs and Literals in RegEx Learn 10 very useful characters and cncepts f RegEx++, enabling yu t write hundreds f expressins Create and interpret a basic regular expressin that includes Functin Grups and Repeat Values Integrate a new RegEx int FTK fr use Integrate a new TR1 Expressin int FTK fr use Create a regular expressin and add it t the list f expressins in the FTK Live Search tab Perfrm a live search using the regular expressin yu created Mdule 10: Filtering the Case Explain basic cncepts f rule-based filtering in FTK Design a basic filter and use it t filter data Manage shared filters Discuss the use f cmpund filters Explain the difference between glbal and tab filters Imprt and exprt filters During the labs, participants create filters t lcate specific items f interest. Students will further refine filter results using cmpund filters. Finally, students will have a change t imprt and exprt filters s they can share filters with c-wrkers and clleagues. Mdule 11: The Recycle Bin Describe the functin f the Windws Recycle Bin Identify the differences in the Recycle Bin n FAT and NTFS systems List what infrmatin can be recvered frm the INFO2 file Describe hw FTK parses and displays INFO2 files Describe what happens when a file is deleted r remved frm the Recycle Bin Explain what happens when a user empties the Recycle Bin Identify hw infrmatin can still be retrieved when items are remved frm the Recycle Bin Describe the frensic implicatins f files lcated in the Recycle Bin Describe the functin f the Orphan flder Create a regular expressin t recver unallcated INFO2 file recrds Retrieve deleted evidence frm the Recycle Bin Use a regular expressin t lcate INFO2 files Retrieve the fllwing infrmatin frm INFO2 files Deleted File Path Deleted File Index Deleted File Drive Number Deleted File Date and Time LAB, Passwrd Recvery Tlkit, PRTK, Registry Viewer, and Ultimate Tlkit are registered trademarks f the AccessData Grup, LLC. in the United States and/r ther cuntries. Other trademarks referenced are prperty f their respective wners.

6 AccessData Advanced Frensics Intermediate Five-Day Instructr-Led Curse Mdule 12: Cmmn Windws XP Artifacts Thumbs.db Files Define the Thumbs.db file Define Thumbs.db behavir Identify thumbnail graphics Define EFS file changes and Thumbs.db behavir Use FTK t recver graphics infrmatin frm Thumbs.db files Link and Spl Files Define the functin f a link file Identify what evidentiary infrmatin is cntained in link files Describe hw FTK parses and displays link files Define the functin f a spl file and its related files Identify what evidentiary infrmatin is cntained in spl files Use FTK t recver frensic infrmatin frm link files, including the MAC address f the target machine Use link file data t assciate a file with a USB drive Use FTK t recver frensic infrmatin frm spl files Alternate Data Streams Identify the differences between named and alternate data streams Identify frensic issues assciated with alternate data streams Identify hw Frensic Tlkit (FTK) displays alternate data streams Describe hw alternate data streams impact file size, disk space, and file creatin date Identify alternate data stream files in yur case Windws Prefetch Accurately define Prefetch, Superfetch, and their related functins Definte the frensic imprtance f Prefetch Registry entries, Prefetch files, and the Layut.ini file View and analyze pertinent Prefetch artifacts as they relate t case analysis and user behavir View Prefetch settings in the Registry View Prefetch entries in FTK t find the last date and time an applicatin was launched View Prefetch entries in FTK t determine the number f times an applicatin was launched LAB, Passwrd Recvery Tlkit, PRTK, Registry Viewer, and Ultimate Tlkit are registered trademarks f the AccessData Grup, LLC. in the United States and/r ther cuntries. Other trademarks referenced are prperty f their respective wners.

7 AccessData Advanced Frensics Intermediate Five-Day Instructr-Led Curse Mdule 13: Wrking with PRTK Navigate within the PRTK interface Identify the available passwrd recvery mdules and their assciated attack types Imprt user-defined dictinaries and FTK wrd lists t use in a passwrd recvery attack Create bigraphical dictinaries Set up prfiles Explain what a PRTK prfile is and hw it is used Recunt the AccessData Methdlgy Recver Windws lgn passwrds Exprt encrypted files frm a case Exprt a wrd list and create a custm dictinary Create a Bigraphical dictinary Create a prfile Recver a passwrd Lcate SAM and SysKey Files Attack and decrypt encrypted files, then list the recvered passwrds Mdule 14: Encrypting File System Describe hw EFS wrks List the infrmatin required t recver EFS encrypted files n Windws 2000 systems List the infrmatin required t recver EFS ecrypted files n Windws XP Prfessina Service Pack 1 (SP1) and later systems List ptential prblems assciated with recvering EFS encrypted data Create EFS encrypted files Recver EFS encrypted files in FTK Mdule 15: Case Reprting Define a reprt Mdify the case infrmatin Include a list f bkmarked files Exprt bkmarked files with the reprt Include thumbnails f bkmarked graphics Manage the appearance f the Bkmark sectin Include thumbnails f case graphics Link thumbnails t full-sized graphics in the reprt directry Exprt and link vide files Exprt rendered vides and thumbnails Include a list f directries, subdirectries, files, and file types Include a list f case files and file prperties in the reprt Exprt case files assciated with specific file categries Append a registry reprt t the case reprt Generate reprts in the fllwing frmats: PDF HTML RTF WML XML DOCX ODT Generate reprts in ther languages During the practical, participants create multiple reprts frm a single case t explre all ptins available frm the reprt wizard. They build frm a very basic reprt t a detailed reprt that cntains custmized reprt items. LAB, Passwrd Recvery Tlkit, PRTK, Registry Viewer, and Ultimate Tlkit are registered trademarks f the AccessData Grup, LLC. in the United States and/r ther cuntries. Other trademarks referenced are prperty f their respective wners.

8 AccessData Btcamp Intermediate Three-Day Instructr-Led Curse The AccessData Btcamp three-day curse prvides the knwledge and skills necessary t install, cnfigure, and effectively use Frensic Tlkit (FTK), FTK Imager Passwrd Recvery Tlkit (PRTK) and Registry Viewer. Prerequisites This hands-n class is intended fr new users, particularly frensic prfessinals and law enfrcement persnnel, wh use AccessData frensic sftware t examine, analyze, and classify digital evidence. T btain the maximum benefit frm this class, yu shuld meet the fllwing requirements: Able t understand curse curriculum presented in English Perfrm basic peratins n a persnal cmputer Have a basic knwledge f cmputer frensic investigatins and acquisitin prcedures Be familiar with the Micrsft Windws envirnment Class Materials and Sftware Yu will receive the assciated materials prir t the curse. During this three-day, hands-n curse, participants will perfrm the fllwing tasks: Install and cnfigure FTK, FTK Imager, PRTK, and Registry Viewer Use FTK Imager t preview evidence, exprt evidence files, create frensic images and cnvert existing images Review Registry Viewer functins, including indexing the registry, creating reprts and integrating thse reprts with yur FTK case reprt Create a case in FTK Use FTK t prcess and analyze dcuments, metadata, graphics and Use bkmarks and check marks t efficiently manage and prcess case data Update and custmize the KFF database Create and apply file filters t manage evidence in FTK Use regular expressins t perfrm live searches Imprt search lists fr indexed searches in FTK Use the FTK Data Carving feature t recver files frm unallcated disk space Create and custmize reprts Use custm dictinaries and dictinary prfiles t recver passwrds in PRTK Utilize the index in FTK t create custm dictinaries in PRTK The curse includes multiple hands-n labs that allw students t apply what they have learned in the wrkshp. (Cntinued n ther side) LAB, Passwrd Recvery Tlkit, PRTK, Registry Viewer, and Ultimate Tlkit are registered trademarks f the AccessData Grup, LLC. in the United States and/r ther cuntries. Other trademarks referenced are prperty f their respective wners.

9 AccessData Btcamp Intermediate Three-Day Instructr-Led Curse Mdule 1: Intrductin Tpics: Identify the FTK cmpnents List the FTK and PRTK system requirements Describe hw t receive upgrades and supprt fr AccessData tls Install required applicatins and drivers Participants will install the UTK cmpnents FTK, KFF Library, FTK Imager, Registry Viewer, and PRTK Mdule 2: Wrking with FTK Imager Describe standard data strage devices Identify sme cmmn sftware and hardware acquisitin tls List sme cmmn frensic image frmats Use FTK Imager t perfrm the fllwing functins: Preview evidence Exprt data files Create a hash t benchmark yur case evidence Acquire an image f evidence data Cnvert existing images t ther frmats Use dckable windws in FTK Imager Navigate evidence items Use the prperties and interpreters windws Validate frensic images Create Custm Cntent Images Munt images Capture active RAM During the practical participants acquire an image f a thumb drive, then explre the FTK Imager features and functins discussed in the mdule, including cnverting an image t a different image frmat, creating a Custm Cntent Image, and munting an image. Mdule 3: Wrking with Registry Viewer Describe which files cmprise the Windws Registry Discuss the elements f the Registry Viewer interface Identify the key features f the Registry Viewer Outline the use f FTK with ther tls Create a basic reprt frm FTK Seamlessly launch Registry Viewer frm an FTK case Determine a user s time zne setting Determine a user s SID During the practical, participants use Registry Viewer t recver infrmatin frm a sample image. Participants will then generate registry reprts fr individual registry files. Mdule 4: Wrking with FTK Part 1 Effectively use the Case Manager Create an administer users Back up, delete, and restre cases Identify the evidence prcessing ptins Create a case Identify the basic FTK interface cmpnents, including the menu and tlbar ptins as well as the prgram tabs Obtain basic analysis data During the practical, participants g thrugh the intrductry steps f prcessing a case, including creating a case, adding evidence t the case, and prcessing case evidence. Students will als perfrm basic system functins such as creating user accunts and defining different levels f permissins t a case, managing shared bjects, and custmizing the FTK interface. LAB, Passwrd Recvery Tlkit, PRTK, Registry Viewer, and Ultimate Tlkit are registered trademarks f the AccessData Grup, LLC. in the United States and/r ther cuntries. Other trademarks referenced are prperty f their respective wners.

10 AccessData Btcamp Intermediate Three-Day Instructr-Led Curse Mdule 5: Wrking with FTK Part 2 Change time zne display Create and manage bkmarks View cmpund files Exprt files and flders Create custm clumn settings t manage the infrmatin that appears in the FTK file list Use the Cpy Special and Exprt File List Inf features Perfrm additinal analysis, such as full text indexing, after evidence has been added t the case Perfrm autmatic and manual data carving functins The labs in this mdule guide participants thrugh mre advanced functins in prcessing case evidence. During the practical, participants will bkmark evidence, view metadata and cmpund files, examine registry files, recver deleted files frm the Recycle Bin, exprt case files and flders, create custm clumn settings, decrypt files, and use the data carving feature t recver evidence items frm file slack and unallcated space. Mdule 6: Prcessing the Case Identify the elements f a graphics case Navigate the FTK Graphics tab Exprt graphics files and hash sets Tag graphics files using the Bkmarks feature Identify the elements f an case Identify supprted types Navigate the FTK tab Srt Find a wrd r phrase in an message r attachment Exprt items During the practical, participants explre FTK features t view, srt, and exprt and graphic artifacts frm the case. Students will als create custm clumns fr graphics and , exprt and graphics files, and create a hash list. Mdule 7: Narrwing Yur Fcus Narrw evidence items using the Knwn File Filter, checked items, and filtered/ignred items Perfrm an indexed search Imprt search terms frm text files Perfrm a regular expressin search During the practical, participants learn hw t effectively srt thrugh case evidence t lcate items f interest. Students will use the KFF database t ignre r flag knwn files, perfrm keywrd searches, use dtsearch ptins t custmize a search, and use regular expressins t search case evidence fr pattern data such as credit card numbers r IP addresses. Mdule 8: Filtering the Case Explain basic cncepts f rule-based filtering in FTK Design a basic filter and use it t filter data Manage shared filters Discuss the use f cmpund filters Explain the difference between glbal and tab filters Imprt and exprt filters During the labs, participants create filters t lcate specific items f interest. Students will further refine filter results using cmpund filters. Finally, students will have a change t imprt and exprt filters s they can share filters with c-wrkers and clleagues. LAB, Passwrd Recvery Tlkit, PRTK, Registry Viewer, and Ultimate Tlkit are registered trademarks f the AccessData Grup, LLC. in the United States and/r ther cuntries. Other trademarks referenced are prperty f their respective wners.

11 AccessData Btcamp Intermediate Three-Day Instructr-Led Curse Mdule 9: Case Reprting Define a reprt Mdify the case infrmatin Include a list f bkmarked files Exprt bkmarked files with the reprt Include thumbnails f bkmarked graphics Manage the appearance f the Bkmark sectin Include thumbnails f case graphics Link thumbnails t full-sized graphics in the reprt directry Exprt and link vide files Exprt rendered vides and thumbnails Include a list f directries, subdirectries, files, and file types Include a list f case files and file prperties in the reprt Exprt case files assciated with specific file categries Append a registry reprt t the case reprt Generate reprts in the fllwing frmats: PDF HTML RTF WML XML DOCX ODT Generate reprts in ther languages During the practical, participants create multiple reprts frm a single case t explre all ptins available frm the reprt wizard. They build frm a very basic reprt t a detailed reprt that cntains custmized reprt items. Mdule 10: Wrking with PRTK Navigate within the PRTK interface Identify the available passwrd recvery mdules and their assciated attack types Imprt user-defined dictinaries and FTK wrd lists t use in a passwrd recvery attack Create bigraphical dictinaries Set up prfiles Explain what a PRTK prfile is and hw it is used Recunt the AccessData Methdlgy During the labs, participants will use PRTK t recver passwrds frm data files. Students will als apply the AccessData Methdlgy t decrypt files in a sample image. This prcess will require students t exprt the FTK case index and Registry Viewer s registry index t create a custm dictinary, create a bigraphical dictinary and custm prfiles, then re-apply intel gathered frm decrypted files t attack ther encrypted files. LAB, Passwrd Recvery Tlkit, PRTK, Registry Viewer, and Ultimate Tlkit are registered trademarks f the AccessData Grup, LLC. in the United States and/r ther cuntries. Other trademarks referenced are prperty f their respective wners.

12 AccessData Linux Frensics Advanced One-Day Instructr-Led Curse AccessData Linux Frensics curse prvides the knwledge and skills necessary t install, cnfigure and effectively use Frensic Tlkit (FTK ), FTK Imager Passwrd Recvery Tlkit (PRTK ), and Registry Viewer. Prerequisites: T btain the maximum benefit frm this curse, yu shuld meet the fllwing requirements: Able t understand curse curriculum presented in English AccessData BtCamp r equivalent experience with FTK and PRTK Have a basic knwledge f cmputer frensic investigatins and acquisitin prcedures Perfrm basic peratins n a persnal cmputer Be familiar with the Linux envirnment Class Materials and Sftware: Yu will receive the assciated materials prir t the curse. During this ne-day, hands-n curse, participants will review the fllwing: Cmmn Linux Distributins General Linux File Structure, Cmmands and Applicatins Linux OS Artifacts Printer infrmatin Installed sftware USB Tracking Distributin in Use Wireless Netwrk Infrmatin Time Zne Infrmatin Cmputer Hst Name User Prfile Infrmatin System-related Data in the User Prfile Track Flder Bash Histry Thumbscaching.cache Flder Artifacts.cnfig Flder Artifacts Files and Flders Accessible t the User User-related Artifacts fr Default Applicatins Firefx Thunderbird XChat Pidgin This curse includes multiple hands-n labs that allw students t apply what they have learned in the wrkshp. (Cntinued n ther side) LAB, Passwrd Recvery Tlkit, PRTK, Registry Viewer, and Ultimate Tlkit are registered trademarks f the AccessData, Inc. in the United States and/r ther cuntries. Other trademarks referenced are prperty f their respective wners.

13 AccessData Linux Frensics Advanced One-Day Instructr-Led Curse Mdule 1: Intrductin Tpics: Intrductins Class Materials and Sftware Prerequisites Class utline Helpful infrmatin Check system infrmatin Select Windws Explrer display preferences Prepare yur system Mdule 2: Linux Overview Outline the histry f the Linux perating system Describe cmmn Linux directries and their functins Describe cmmn Linux cmmands and their purpse Describe cmmn Linux applicatins Navigate a Linux image in FTK t cllect system artifacts Open a virtual machine in WMWare Player Navigate the desktp and prgram menus Using the terminal t navigate the file system Using the terminal t manage files and directries Mdule 3: Linux OS Artifacts Lcate infrmatin abut cnfigured printers Identify sftware installed n Debian-derived distributins Identify USB devices cnnected t the system Identify which distributin is in use Lcate infrmatin abut wireless and wired netwrks cnfigured n the system Determine the system s time zne Determine the system s hst name Examine Linux system lg rtatin Examine wireless and wired netwrk cnnectins Lcate system printer infrmatin Lcate sftware installatin infrmatin Track USB devices Identify users wh have lgged in t a Linux system Identify failed lgin attempts Identify users wh have SuperUser access Lcate the cmputer name Identify cmputers allwed t access a lcal system Identify cmputers denied access t a lcal system Identify symblic links Navigate the rt user s hme directry Data carve the Linux swap partitin Mdule 4: Lab User Prfile System Related Identify user accunts n the lcal system and determine grup memberships Identify UNIX permissins applied t bjects n a Linux system and determine wnership List and describe user prfiles Lcate additinal user data beynd the hme directry Analyze cre artifacts pertaining t: Recycling f user files Trash flder Histry f cmmands entered int the terminal windw-bash Thumbs caching artifacts Cntents f the.cache flder Cntents f the.cnfig flder Explre the passwrd file Explre the shadw file Identify user lgin passwrds Set up a jb with PRTK Attack encrypted dcuments using Decrypt a shadw file Use the recvered passwrd Lcate the passwrd in FTK Analyze system-related data in the user prfile LAB, Passwrd Recvery Tlkit, PRTK, Registry Viewer, and Ultimate Tlkit are registered trademarks f the AccessData, Inc. in the United States and/r ther cuntries. Other trademarks referenced are prperty f their respective wners.

14 AccessData Linux Frensics Advanced One-Day Instructr-Led Curse Mdule 5: User Prfiles User Related Tpics: Identify files and flders accessible t a given user Research internet usage histry fr Firefx Navigate strage fr Thunderbird Parse IRC lgs and infrmatin fr the XChat IRC client Analyze accunt infrmatin fr the Pidgin instant messenger client Review the user s default directries Review recent file activity Lcate Firefx artifacts and passwrd cache Recver Firefx cached data Recver Thunderbird Review the dwnlads directry fr the RC client Recver Instant Messenger artifacts (pidgin) LAB, Passwrd Recvery Tlkit, PRTK, Registry Viewer, and Ultimate Tlkit are registered trademarks f the AccessData, Inc. in the United States and/r ther cuntries. Other trademarks referenced are prperty f their respective wners.

15 AD Triage Advanced One-Day Instructr-Led Curse This advanced ne day curse training curse prvides the knwledge and skills necessary t install, cnfigure, and effectively use the AccessData Triage sftware tl. AD Triage allws bth frensic examiners and nnfrensic persnnel t acquire either all r specifically targeted hard drive data frm a system in just minutes. Prerequisites: T btain the maximum benefit frm this curse, yu shuld meet the fllwing requirements: Able t understand curse curriculum presented in English Perfrm basic peratins n a persnal cmputer Be familiar with the Micrsft Windws envirnment Class Materials and Sftware: Yu will receive the assciated materials prir t the curse. During this ne-day, hands-n wrkshp, participants will review the fllwing: Standard and custm prfiles and hw t create them Standard and custm filters and hw t create them Standard and custm AD Triage devices and hw t create them Using prfiles, filters, and AD Triage devices t cllect data Data cllectin Cllecting data remtely Creating data reprts Remte Shares Using AD Triage t send cllected infrmatin Using AD Triage t Image (Cntinued n ther side) LAB, Passwrd Recvery Tlkit, PRTK, Registry Viewer, and Ultimate Tlkit are registered trademarks f the AccessData, Inc. in the United States and/r ther cuntries. Other trademarks referenced are prperty f their respective wners.

16 AccessData Triage Advanced One-Day Instructr-Led Curse Mdule 1: Intrductin Tpics: Intrductins Class materials and sftware Prerequisites Class utline Helpful infrmatin Mdule 2: Regular Expressins Describe hw AD Triage wrks Discuss Live Respnse versus Dead Bx issues Understand licensing Explain hw t create an AD Triage device Manage licenses Mdule 3: Prfiles and Filters Explain what a standard prfile is Create a standard prfile Explain what a filter is Create a filter Create a standard AD Triage device Create a standard filter Use AD Triage n a virtual machine Create a custm prfile Create a hash grup Create a keywrd list Create a custm filter Mdule 4: Cllecting and Reprting Explain what a custm prfile is Create a custm prfile Create a custm AD Triage device Explain what a reprt it Create a reprt Use filters t create a prfile Create a custm AD Triage device Create a data reprt Mdule 5: Using Remte Shares Discuss Remte Destinatin Understand Remte Shares Use AD Triage t send cllected infrmatin Cnfigure Remte Shares Cllect data Imprt cllectins Mdule 6: Imaging Demnstrate hw t Image with AD Triage See the different imaging ptins. Make an AD1 image f files. LAB, Passwrd Recvery Tlkit, PRTK, Registry Viewer, and Ultimate Tlkit are registered trademarks f the AccessData, Inc. in the United States and/r ther cuntries. Other trademarks referenced are prperty f their respective wners.

17 Advanced FTK Advanced Three-Day Instructr-Led Curse The AccessData Advanced FTK class prvides the knwledge and skills necessary t effectively use the advanced analysis features f FTK, FTK Imager Passwrd Recvery Tlkit (PRTK ) and Registry Viewer. During this three day, hands n curse, participants will perfrm the fllwing tasks: Prerequisites: Use FTK s advanced prcessing ptins t examine evidence Merging index, setting preferences, saving cases Managing shared bjects bth at a glbal level and a case level Gain and understanding f prcessing ptins and prfiles Use filtering t lcate items f interest quickly Examine Live and Index searching, including TR1 Regular Expressins Utilize Cerberus t lcate pssible malware Use Visualizatin t get a graphic timeline view f files and Internet histry. Use Gelcatin t identify where phts were taken Remte data preview and acquisitin features Understand the requirements and hw t setup Distributed Prcessing Obtain live memry and vlatile data frm a target system and cmplete an analysis f the data This hands-n curse is intended fr users wh have previusly attended the AccessData BtCamp training, particularly frensic prfessinals and law enfrcement persnnel, wh use AccessData frensic sftware t examine, analyze, and classify digital evidence. Previus AccessData BtCamp training Able t understand curse curriculum presented in English Perfrm basic peratins n a persnal cmputer Have a basic knwledge f cmputer frensic investigatins (Cntinued n ther side) LAB, Passwrd Recvery Tlkit, PRTK, Registry Viewer, and Ultimate Tlkit are registered trademarks f the AccessData Grup, LLC. in the United States and/r ther cuntries. Other trademarks referenced are prperty f their respective wners.

18 Advanced FTK Advanced Three-Day Instructr-Led Curse Mdule 1: Intrductin Tpics: Identify the LAB cmpnents List the LAB and PRTK system requirements Describe hw t receive upgrades and supprt fr AccessData tls Mdule 2: Case Setup Merging Index Optimum Setup fr FTK Preferences Archive/Backup Restre Indexing Optins Mdule 3: Advanced Prcessing (Part 1) Managing Shared Objects Carvers Custm Identifiers Clumns File Extensin Maps Filters Labels Pht DNA Evidence Prcessing Prfiles Mdule 4: Advanced Prcessing (Part 2) Managing Shared Objects Pht DNA Windws Event Lgs Prefetch files Explicit Image Detectin Optical Character Recgnitin Examining Vide Files Mdule 5: Advanced Filtering Designing Filters Cmpund Filters Glbal Filters Tab Filters Mdule 6: Advanced Searching Techniques Live Search Optins Text Pattern Hex Index Search dtsearch Indexing Optins Cnducting an Index Search Imprting/Exprting Search Terms Search Operatrs Searching fr a phrase Blean Searches Searching Optins TR1 Regular Expressins Mdule 7: Cerberus Wrking with Registry Viewer What is Cerberus Analysis Cerberus Prcessing Stages Stage 1 Analysis Stage 1 Threat Scring Stage 2 Analysis Stage 2 Reprt Running Cerberus Analysis Reviewing Results in Examiner Exprting a Cerberus Reprt Bkmarking & Reprting Cerberus Files LAB, Passwrd Recvery Tlkit, PRTK, Registry Viewer, and Ultimate Tlkit are registered trademarks f the AccessData Grup, LLC. in the United States and/r ther cuntries. Other trademarks referenced are prperty f their respective wners.

19 Advanced FTK Avanced Three-Day Instructr-Led Curse Mdule 8: Visualizatin Launching Visualizatin Visualizatin Page Themes Visualizatin f Data Files s Scial Analysis Traffic Internet Brwser Histry Gelcatin Mdule 12: Memry and Vlatile Data Analysis What is memry vs. vlatile data Capturing RAM Obtaining vlatile data Adding t case Vlatile tab Reprting Mdule 9: Adding Remte Evidence Describe the Remte Disk Munting Service (RDMS) Deply Temprary Agents Access Remte Data with Temprary Agent Create Digital Certificates Deply Enterprise Agents Access Remte Data with Enterprise Agent Including Memry Munt a drive remtely Preview and Image a drive remtely Mdule 10: Distributed Prcessing Describe the benefits f Distributed Prcessing System Requirements Installing DPE sftware Mdule 11: Vlume Shadw Cpy Describe hw Vlume Shadw Cpy wrks Identify what frensic infrmatin can be recvered frm Vlume Shadw Cpy Use FTK t prcess a retre pint LAB, Passwrd Recvery Tlkit, PRTK, Registry Viewer, and Ultimate Tlkit are registered trademarks f the AccessData Grup, LLC. in the United States and/r ther cuntries. Other trademarks referenced are prperty f their respective wners.

20 AccessData Advanced Frensics Intermediate Five-Day Instructr-Led Curse Mdule 8: Narrwing Yur Fcus Narrw evidence items using the Knwn File Filter, checked items, and filtered/ignred items Perfrm an indexed search Imprt search terms frm text files Perfrm a regular expressin search During the practical, participants learn hw t effectively srt thrugh case evidence t lcate items f interest. Students will use the KFF database t ignre r flag knwn files, perfrm keywrd searches, use dtsearch ptins t custmize a search, and use regular expressins t search case evidence fr pattern data such as credit card numbers r IP addresses. Mdule 9: Regular Expressins Understand basic Operatrs and Literals in RegEx Learn 10 very useful characters and cncepts f RegEx++, enabling yu t write hundreds f expressins Create and interpret a basic regular expressin that includes Functin Grups and Repeat Values Integrate a new RegEx int FTK fr use Integrate a new TR1 Expressin int FTK fr use Create a regular expressin and add it t the list f expressins in the FTK Live Search tab Perfrm a live search using the regular expressin yu created Mdule 10: Filtering the Case Explain basic cncepts f rule-based filtering in FTK Design a basic filter and use it t filter data Manage shared filters Discuss the use f cmpund filters Explain the difference between glbal and tab filters Imprt and exprt filters During the labs, participants create filters t lcate specific items f interest. Students will further refine filter results using cmpund filters. Finally, students will have a change t imprt and exprt filters s they can share filters with c-wrkers and clleagues. Mdule 11: The Recycle Bin Describe the functin f the Windws Recycle Bin Identify the differences in the Recycle Bin n FAT and NTFS systems List what infrmatin can be recvered frm the INFO2 file Describe hw FTK parses and displays INFO2 files Describe what happens when a file is deleted r remved frm the Recycle Bin Explain what happens when a user empties the Recycle Bin Identify hw infrmatin can still be retrieved when items are remved frm the Recycle Bin Describe the frensic implicatins f files lcated in the Recycle Bin Describe the functin f the Orphan flder Create a regular expressin t recver unallcated INFO2 file recrds Retrieve deleted evidence frm the Recycle Bin Use a regular expressin t lcate INFO2 files Retrieve the fllwing infrmatin frm INFO2 files Deleted File Path Deleted File Index Deleted File Drive Number Deleted File Date and Time LAB, Passwrd Recvery Tlkit, PRTK, Registry Viewer, and Ultimate Tlkit are registered trademarks f the AccessData Grup, LLC. in the United States and/r ther cuntries. Other trademarks referenced are prperty f their respective wners.

21 AccessData Advanced Frensics Intermediate Five-Day Instructr-Led Curse Mdule 12: Cmmn Windws XP Artifacts Thumbs.db Files Define the Thumbs.db file Define Thumbs.db behavir Identify thumbnail graphics Define EFS file changes and Thumbs.db behavir Use FTK t recver graphics infrmatin frm Thumbs.db files Link and Spl Files Define the functin f a link file Identify what evidentiary infrmatin is cntained in link files Describe hw FTK parses and displays link files Define the functin f a spl file and its related files Identify what evidentiary infrmatin is cntained in spl files Use FTK t recver frensic infrmatin frm link files, including the MAC address f the target machine Use link file data t assciate a file with a USB drive Use FTK t recver frensic infrmatin frm spl files Alternate Data Streams Identify the differences between named and alternate data streams Identify frensic issues assciated with alternate data streams Identify hw Frensic Tlkit (FTK) displays alternate data streams Describe hw alternate data streams impact file size, disk space, and file creatin date Identify alternate data stream files in yur case Windws Prefetch Accurately define Prefetch, Superfetch, and their related functins Definte the frensic imprtance f Prefetch Registry entries, Prefetch files, and the Layut.ini file View and analyze pertinent Prefetch artifacts as they relate t case analysis and user behavir View Prefetch settings in the Registry View Prefetch entries in FTK t find the last date and time an applicatin was launched View Prefetch entries in FTK t determine the number f times an applicatin was launched LAB, Passwrd Recvery Tlkit, PRTK, Registry Viewer, and Ultimate Tlkit are registered trademarks f the AccessData Grup, LLC. in the United States and/r ther cuntries. Other trademarks referenced are prperty f their respective wners.

22 AccessData Advanced Frensics Intermediate Five-Day Instructr-Led Curse Mdule 13: Wrking with PRTK Navigate within the PRTK interface Identify the available passwrd recvery mdules and their assciated attack types Imprt user-defined dictinaries and FTK wrd lists t use in a passwrd recvery attack Create bigraphical dictinaries Set up prfiles Explain what a PRTK prfile is and hw it is used Recunt the AccessData Methdlgy Recver Windws lgn passwrds Exprt encrypted files frm a case Exprt a wrd list and create a custm dictinary Create a Bigraphical dictinary Create a prfile Recver a passwrd Lcate SAM and SysKey Files Attack and decrypt encrypted files, then list the recvered passwrds Mdule 14: Encrypting File System Describe hw EFS wrks List the infrmatin required t recver EFS encrypted files n Windws 2000 systems List the infrmatin required t recver EFS ecrypted files n Windws XP Prfessina Service Pack 1 (SP1) and later systems List ptential prblems assciated with recvering EFS encrypted data Create EFS encrypted files Recver EFS encrypted files in FTK Mdule 15: Case Reprting Define a reprt Mdify the case infrmatin Include a list f bkmarked files Exprt bkmarked files with the reprt Include thumbnails f bkmarked graphics Manage the appearance f the Bkmark sectin Include thumbnails f case graphics Link thumbnails t full-sized graphics in the reprt directry Exprt and link vide files Exprt rendered vides and thumbnails Include a list f directries, subdirectries, files, and file types Include a list f case files and file prperties in the reprt Exprt case files assciated with specific file categries Append a registry reprt t the case reprt Generate reprts in the fllwing frmats: PDF HTML RTF WML XML DOCX ODT Generate reprts in ther languages During the practical, participants create multiple reprts frm a single case t explre all ptins available frm the reprt wizard. They build frm a very basic reprt t a detailed reprt that cntains custmized reprt items. LAB, Passwrd Recvery Tlkit, PRTK, Registry Viewer, and Ultimate Tlkit are registered trademarks f the AccessData Grup, LLC. in the United States and/r ther cuntries. Other trademarks referenced are prperty f their respective wners.

23 Applied Decryptin Advanced Three-Day Instructr-Led Curse Applied Decryptin is an intensive, hands-n curse that reviews current encryptin technlgy and prvides the knwledge and skills necessary t recver passwrds using PRTK and DNA. This curse intrduces advanced cryptgraphy cncepts, including encryptin standards and file recvery strategies. Participants are guided thrugh a basic cryptgraphic system, including the elements used t create a File Encryptin Key (FEK), passwrds, hash functins, salt, passkey, and the FEK itself. Participants are als intrduced t AccessData decryptin technlgy sftware. The curse utlines hw Passwrd Recvery Tlkit (PRTK) and Distributed Netwrk Attack (DNA) recver passwrds frm cmmn applicatins, including the types f attacks that may be emplyed. It als reviews PRTK and DNA features and functins, including hw t start attack sessins, hw t imprt dictinaries, hw t create attack prfiles, and hw t reprt Sessin/Jb prperties infrmatin. Als key t this curse is AccessData Decryptin Methdlgy. Students review tactics like generating dictinaries based n suspect intelligence r exprting a wrd list frm FTK, then imprting the wrd list in PRTK r DNA t build an attack prfile. After setting up the framewrk f decryptin tls and strategies, this curse fcuses n hw t attack specific encryptin technlgies, including: PGP: Participants review digital signatures and certificates, with a specific discussin abut the PGP Web f Trust including hw the Web f Trust can be implemented, methds a third-party may use t infiltrate the grup, and man-in-themiddle attacks. Encrypted Cntainers: Participants first learn hw a virtual cntainer file is viewed with a frensic tl when it is nt munted with the native applicatin. This is fllwed by a discussin f hw t recver passwrds fr encrypted cntainers s that yu can natively munt the vlume. Participants als discuss best-practice prcedures t acquire a frensic image f the munted virtual cntainer using FTK Imager. EFS: Participants gain an understanding f hw the Encrypting File System (EFS) wrks and hw EFS file data can be recvered. Participants learn where Windws stres the encryptin and decryptin keys and hw t explit weaknesses within the Windws perating system t btain these keys and decrypt the data. They are als given detailed instructin n the steps required fr FTK t decrypt EFS file data n Windws 2000 and Windws XP SP1 systems. Prtected Strage in Internet Explrer Versins 7-9: Participants discuss the definitin, functin, and frensic imprtance f prtected strage artifacts assciated with the Micrsft Internet Explrer Brwser. Data Within Data: Participants are intrduced t stegangraphy the cncept f data cncealed within data and hw t frensically prcess such files. System BitLcker and BitLcker T G: Participants review sme f the cre functins related t acquiring BitLckerencrypted evidence. Participants first learn hw t identify an encrypted vlume. The curse then presents different ways t decrypt and frensically acquire data frm a BitLcker-prtected drive. Prerequisites: This curse is intended fr frensic investigatrs with experience in frensic case wrk and a basic wrking knwledge f FTK, FTK Imager, Registry Viewer, and PRTK. T btain the maximum benefit frm this curse, yu shuld meet the fllwing requirements: Able t understand curse curriculum presented in English AccessData BtCamp r equivalent experience with FTK and PRTK Previus investigative experience in frensic case wrk Class Materials and Sftware: Yu will receive the assciated materials prir t the curse. (Cntinued n ther side) LAB, Passwrd Recvery Tlkit, PRTK, Registry Viewer, and Ultimate Tlkit are registered trademarks f the AccessData, Inc. in the United States and/r ther cuntries. Other trademarks referenced are prperty f their respective wners.

24 Applied Decryptin Advanced Three-Day Instructr-Led Curse Mdule 1: Intrductin Tpics: Intrductins Class Materials and Sftware Prerequisites Class utline Helpful infrmatin Check system infrmatin Select Windws Explrer display preferences Prepare yur system Mdule 2: Cryptgraphy 201 Define cryptgraphy and the difficulty levels prvided by different algrithms List the different types f passwrds and standards defined by sftware applicatins Define cryptgraphy terminlgy Describe the cncepts and thery f basic cryptgraphy systems Describe symmetric and asymmetric encryptin standards Describe hw digital certificates and signatures are used t encrypt data During the lab, participants cnduct exercises in ROT13, XOR, and manually btain passwrds frm Trillin *.ini files. Mdule 3: Decryptin Technlgy Describe the PRTK/DNA interface Utilize the recvery mdules Imprt and use dictinaries, rules, and characters t set up an attack prfile List the steps t successfully break passwrds Describe jbs and hw t analyze their prperties During the lab, participants review the menu ptins in DNA, install a DNA Wrker, run a jb in PRTK and DNA, and imprt a custm dictinary. Mdule 4: Wrking with DNA Plan and install a DNA netwrk Set up and manage grups f machines Describe the DNA interface and preferences Set up the ptins and resurces available t crack passwrds Describe hw t trublesht DNA During the lab, participants review the DNA interface and management ptins. Mdule 5: AccessData Decryptin Methdlgy Attack encrypted dcument using wrdlists Wrd lists frm images Wrd lists that maintain case and symbls Wrd lists frm memry captures Attack encrypted dcuments using envirnment artifacts Investigate and uncver suspect intelligence t attack an encrypted dcument Create alternate dictinaries with a WebCrawler Create a passphrase dictinary with the AccessData Passphrase Generatr Attack encrypted dcuments using wrdlists Participants recver passwrds and decrypt files by cmpleting each f the fllwing steps f the AccessData Decryptin Methdlgy: Exprt an FTK wrd list Create wrd lists frm a memry capture Recver passwrds stred in an individual user s registry file: NTUSER.DAT Create bigraphical dictinaries frm suspect intelligence Use WebCrawler t create an alternate dictinary frm Web artifacts Generate passphrases frm a dictinary. LAB, Passwrd Recvery Tlkit, PRTK, Registry Viewer, and Ultimate Tlkit are registered trademarks f the AccessData, Inc. in the United States and/r ther cuntries. Other trademarks referenced are prperty f their respective wners.

25 Applied Decryptin Advanced Three-Day Instructr-Led Curse Mdule 6: Lab - Decrypting Selected Applicatins Learn the ins and uts f using rules Recver passwrds frm encrypted Office dcuments Recver extended ASCII passwrds Recver freign language character set passwrds Recver symbl substitutin passwrds Create a cncatenatin dictinary Perfrm reset, decryptin, dictinary, and keyspace attacks Explre a variety f different file type attacks Mdule 7: Wrking with PGP During this practical, yu will perfrm the fllwing tasks: Generate public and private keys in PGP Implement the web f trust with digital signatures Break PGP key rings Participants use the AccessData Decryptin Methdlgy t break PGP key rings. Mdule 8: Wrking with Encrypted Cntainers Decrypt a virtually encrypted cntainer Munt the decrypted virtual cntainer Create an image f the munted virtual cntainer Obtain header infrmatin frm encrypted cntainers Mdule 9: Encrypting File System Describe hw EFS wrks List the infrmatin required t recver EFS encrypted files n Windws systems List what infrmatin is required t recver EFS encrypted files n Windws XP Prfessinal Service Pack 1 (SP1) and later systems List ptential prblems assciated with recvering EFS encrypted data Discuss traditinal attacks using the user s lgin passwrd and using saved keysets frm a.pfx file Participants use DNA t crack a SAM lgn passwrd. Subsequently, participants use the AccessData Decryptin Methdlgy and a.pfx keyset t decrypt EFS files. Mdule 10: Prtected Strage in Internet Explrer Versins 7-9 Cmpare and cntrast the Prtected Strage System Prvider (PSSP) in Windws 2000/XP systems (Internet Explrer 6) with Windws Vista and Windws 7 DPAPI (specifically, systems using Internet Explrer versins 7 9). List the steps required t decrypt the prtected infrmatin lcated in the IntelliFrms subkey in Internet Explrer versins 7-9. List the steps required t break the user s lgn passwrd Participants use FTK Imager t harvest live registry files, then break the assciated user s lgn passwrd using FTK and PRTK. Mdule 11: Wrking with Data Within Data During this practical, yu will perfrm the fllwing tasks: Hide data using stegangraphy Identify stegangraphy detectin methds Statistically analyze surce and carrier files Recver paylad frm carrier files Mdule 12: System BitLcker and BitLcker T G Identify the fundamentals f BitLcker encryptin and hw it is implemented in Windws 7 and Windws 8 Successfully image and access data frm a seized system that is prtected by BitLcker. LAB, Passwrd Recvery Tlkit, PRTK, Registry Viewer, and Ultimate Tlkit are registered trademarks f the AccessData, Inc. in the United States and/r ther cuntries. Other trademarks referenced are prperty f their respective wners.