This course will provide an in-depth look at The Sleuth Kit and Foremost. These two complementary software packages are a reliable set of tools useful for analyzing forensic evidence from multiple file systems, including Windows- (NTFS and FAT) and Linux-based (EXT2 and EXT3) file systems.

As a forensic investigator, it is important to understand multiple ways to find and recover data from collected evidence. You will learn how to perform string searches looking for an e-mail address or bytes found at the beginning of a zip file in order to recover the pertinent data from your evidence and determine the filename that contains that data. Additionally, you will learn how to accomplish data recovery using the data layer and the meta-data layer of the file system.

Performing hash database comparisons and file type sorting is also a very powerful way to help narrow the focus of an investigator. You will learn how to create a forensic hash database and use it to identify known and potentially malicious data in your evidence.

Finally, you will learn how an automated toolkit works to help you speed up the process of an investigation using the Autopsy Forensic Browser and discuss how similar commercial tools perform the same functionality.

The techniques covered in the course today utilize similar techniques that will successfully analyze Windows NTFS/FAT file systems as well as Unix-based file system variations, such as Ext2/3, UFS, and FFS.