IR250 - Incident Investigation

Duration: 4 Days

This hands-on course focuses on the use of EnCase Endpoint Investigator (EnCase) and other tools to acquire and analyze data in a manner that demonstrates the relevance of various file system, network, and memory-based artifacts in the context of an investigative scenario. Students will examine the different factors that affect incident investigations, including planning, basic forensic principles, and examination and response options. They will observe how failing to take note of important issues and implement suitable policies can lead to weaknesses in IT infrastructure and the loss of evidential data. Conversely students will learn to appreciate the benefits of forward planning, employee education, audit and event logging, and suitable access-control policies. This course is very much focused on the recovery of data for the purposes of an investigation and the context in which said data may prove valuable. Students will participate in practical exercises throughout the course to underscore and drive home the skills taught.

Delivery method: Group-Live. NASBA defined level: basic

CPE Credits - 32

Students attending this course will learn the following:

• Incident investigation/response considerations
• How to capture disk and memory data using EnCase Endpoint Investigator and other tools
• The significance of Windows Registry and file-system metadata, paying particular attention to the NT file system (NTFS) and timestamp analysis
• How to identify and recover data encrypted using the Microsoft® Encrypting File System (EFS) and BitLocker®; also how properly applied group policies can help to recover said data and the potential significance of NTFS alternate data streams
• The benefits of USN change log and ShellBag analysis and how they may complement one another
• The significance and analysis of shortcut link files and jumplists
• Windows event log and $LogFile analysis
• Microsoft Windows® Recycle Bin mechanics and analysis
• Examination of volume shadow copies
• Memory analysis using Volatility; also the recovery of passwords, encryption keys, and other data from memory dumps
• Determining the nature, identity, and provenance of files and folders using hash, signature, and USN change log analysis
• Identification and recovery of artifacts from Internet Explorer, Edge, Firefox, and Chrome

Please note that this course touches on subjects covered by other EnCase Training courses, so attendees of those courses may experience a small overlap.

Course Syllabus

Audience

This entry-level course is intended for digital forensic investigators, including IT specialists, security analysts, DFIR practitioners, and traditional digital investigators. Participants should have Foundations level EnCase skills.

Prerequisites

Participants should have attended the EnCase course, DF120–Foundations in Digital Forensics.