Cyber Defense - Forensics
About This Course
This comprehensive course is designed to equip participants with the necessary skills to investigate and analyse digital evidence in the aftermath of cyberattacks. Throughout the programme, participants will gain expertise in capturing network traffic, recovering hidden files, and analysing memory from both Windows and Linux systems. They will also develop the ability to reconstruct attack timelines, extract evidence from disks and file systems, and analyse malware to understand its capabilities and potential impact.
By the completion of the course, participants will be prepared to collect, analyse, and present forensic evidence for legal proceedings and incident response teams.
What You'll Learn
- Master techniques for acquiring digital evidence from networks, storage devices, and system memory
- Develop proficiency in analysing network traffic, file systems, and system memory for forensic artifacts
- Understand how to use Volatility and other tools for memory forensics investigations
- Reconstruct the timeline of a cyberattack based on collected evidence
- Identify and analyse malware samples to understand their functionality and impact
Entry Requirements
Networking Concepts: A solid understanding of fundamental networking concepts like IP addressing, protocols (TCP/IP, UDP), and network topologies is essential. This knowledge allows students to grasp how network traffic is captured and analyzed for forensic purposes.
Computer Security Principles: Familiarity with basic security principles like authentication, authorization, and encryption will provide a foundation for understanding digital evidence and potential attack vectors.