Computer Forensic Investigators should be conversant with network and file system forensics in addition to being armed with the latest in incident response tools and methodologies. The day starts with learning how to acquire system memory, volatile data, and the hard drive as evidence from a compromised machine. You will learn how to acquire evidence across a network, from a live machine, and even from a hard drive that is sent to you for examination. The latter part of the day will focus on file system timeline analysis where you will be able to track the intruder through the file system by examining file system time stamps.

You will analyze live machines that will put you personally in charge of investigating an incident. Part of the courseware DVD includes a compromised VMware machine that was suspended immediately after being hacked remotely for you to test your incident response and evidence collection skills. You will learn how to minimize damage to the evidence of the live machine while learning how to acquire volatile evidence from the machine. Finally, you will learn how to image a hard drive as evidence and maintain evidence integrity through a variety of methods using the SIFT kit.

You are encouraged to bring a used hard drive from your organization or from home to practice on during the evidence acquisition section, but this is not required. The instructor will demonstrate the skills discussed in the course and the manuals will include numerous screen shots.