OBJECTIF

This course will teach you how to set up a complete inforensic analysis procedure for heterogeneous environments. You will discuss the incident response from an organizational point of view. You will also study the appropriate methodologies and tools used in the technical phase of the incident response, namely the info-rensic (or post-incident) analysis. Upon completion of the training, you will be able to preserve the digital evidence for further analysis and presentation as part of a legal remedy.

In particular, the objectives of the training are:

• Be able to define and implement a rigorous incident response process
• Properly collect the evidence needed for quality analysis and possible prosecution

PREREQUISITES

• Good general knowledge in computer science

GENERAL INFORMATION

• Code : AIARI
• Duration: 3 Days
• schedule : 8h30 - 17h30
• place : training center, Center Urbain Nord

TARGETED AUDIENCE

• •IT professionals in charge of information systems security, incident response or forensic investigation

RESOURCES

• Course materials
• 40% demonstration
• 40% of theory
• 20% practical exercises

PROGRAM OF TRAINING

• Days 1
• The basics of incident response and inforensic analysis

Setting up the incident response

• Incident response preparation
• Detection and analysis
• Classification and prioritization
• Notification
• Confinement
• Forensic investigation
• Eradication and resumption of activity


• Inforensic analysis and French legislation
• Methodology and tools for the inforensic analysis

• Get organized
• Choose your tools
• Respect scientific methods
• Present findings in a report


• Days 2
• Approach of the inforensic analysis on the main technical fields

Data collection and duplication

• Understanding Windows, Linux and BSD file systems
• Tools and means of collection


Find deleted partitions and files


Network Attack Analysis


• The sources of capture
• Review of widespread attacks


Recovery and analysis of a RAM capture (Volatility)

• Days 3
• Targeted analyzes and advanced exercises

Log file analysis and event correlation

• Manual approach
• Using an indexer (ELK)


Inforensic Browser Analysis

Inforensic analysis of e-mails

• Putting into practice on concrete cases