🎭
Cybersecurity Journey
  • 💻Cybersecurity Learnings & Musings
  • whoami
  • Cyber Threat Intelligence
    • Cognitive Bias
    • CyberCrimeCon 2021
    • Cyber Threat Intelligence Summit 2022
    • Cyber Security Threat Intelligence Researcher Preview
    • Using ATT&CK for Cyber Threat Intelligence Training
    • Introduction to EASY Framework for Intelligence
    • Foundations of Purple Teaming
    • SANS OSINT Summit 2022
    • MITRE ATT&CK Defenderâ„¢ (MAD) ATT&CK® Fundamentals Badge Training
    • MITRE ATT&CK Defenderâ„¢ (MAD) ATT&CK® Cyber Threat Intelligence Certification Training
  • Forensics
    • Become Computer Forensics Expert & Start your career!
  • Cybersecurity Too Fun (CTF)
    • TISC 2021
    • 2021 SANS Holiday Hack Challenge & KringleCon
    • Elastic Capture the Flag - ASEAN - Jan 2022
    • CSIT Mini Challenge
    • CyberSOC | Cyber Investigator CTF
    • Recorded Future CTF
    • Hack-a-Sat 3
  • OSINT Power
    • Resource List
    • Setups
    • Reports
  • CTI CAREERS
    • [Intro] Web Recon
    • Threat Fusion Analytic Techniques Lead - Corporate Security
    • Senior Investigator - Threat Disruption (Trust & Safety)
    • Investigations Specialist
    • Intel Analyst (Converged Intel Analyst)
    • Intel Analyst (Threat Pursuit)
    • Investigations Specialist - APAC
    • Threat Intelligence Analyst
    • Cyber Threat Intel Analyst
    • Threat Analyst
    • OSINT Technologist
    • Cyber Threat Intelligence (CTI) Analyst
    • Cyber Threat Intelligence Analyst
    • Cyber Threat Hunter (Government Agencies)
    • Senior Cyber Threat Intel Analyst
    • Cyber Threat Intelligence Consultant
    • Threat Analyst
    • Cyber Threat Intelligence Analyst
    • Senior Threat Intelligence Analyst
    • Intelligence Consultant
    • Threat and Risk Analyst
    • Threat Fusion Program Intelligence Analyst - Corporate Security
    • Threat Intelligence Researcher
    • Lead Global Threat Intelligence Analyst
    • Security Investigator
    • SOACC Intelligence Analyst
    • Lead Global Threat Intelligence Analyst
    • Sr. Security Researcher
    • Global Cyber Threat Intelligence Analyst
    • Threat Pursuit Analyst - FUSE Intel
    • Vice President, Cyber Threat Intelligence Analyst
    • Intelligence Analyst II - EIS
    • Assistant Vice President - IT Security (Senior Threat Hunting and Incident Response Analyst)
    • Senior Cyber Threat Intelligence Analyst
    • Threat Intelligence Analyst
    • Cyber Threat Intelligence Analyst is a specialist role within UOB’s Group Security Operations Center
    • Tactical Cyber Threat Intelligence Analyst
    • Threat and Intel Analyst
    • Cyber Threat Intelligence Analyst
    • Web Intelligence Analyst
    • Threat Intelligence Researcher
    • Intelligence Officer
    • Senior Cyber Threat Intelligence Analyst
    • Threat Intel Analyst
    • Lead Analyst, Threat Intelligence
    • Embedded Intelligence Analyst- Dangerous Organisations & Individuals SIBU43
    • Threat Intelligence Analyst
    • Cyber Threat Intelligence Lead
  • Forensics/ IR Careers
    • SOC Incident Responder (AVP)
    • Cyber and Response Manager, Forensics Technology, Assurance
    • Digital Forensic Incident Response Analyst (Malware Analysis)
    • Security Analyst – Security Service Line
    • Digital Forensic Specialist
    • Global Digital Investigator & AP Team Lead
    • Digital Forensics Incident Responder
    • Manager (Digital Forensics)
Powered by GitBook
On this page
  1. Forensics

Become Computer Forensics Expert & Start your career!

PreviousMITRE ATT&CK Defender™ (MAD) ATT&CK® Cyber Threat Intelligence Certification TrainingNextTISC 2021

Last updated 3 years ago

Udemy course: by EH Academy approx. 1.5hrs long

Things you will learn:

  • Understand the process to handle a crime scene

  • Conduct computer forensics analysis to find the evidence

  • Maintain the integrity of the data and will able to perform hashing

  • Learn the process to acquire disk images and the process to analyze disks

Notes

Computer Forensics Process

  1. Collection - plan for acquiring the data and what are the sources of data

  2. Examination - sift and extract data of interest for evidence

  3. Analysis - analyse data gathered and draw conclusions

  4. Reporting - present information

  • Disk imaging - exact copies of storage media and protect the original data storage.

  • Evidence: evidence is hidden

  • Destination image types:

(a) Raw (disk dump)

(b) E01 (encase file format)

(c) SMART (metadata is on another file)

(d) AFF (data and meta are all in a file)

  • Create image and note hash values. If hash values are altered, data integrity is lost.

  • Important to validate hash value before and after copy to ensure nothing is altered.

Analyse disk image on Windows:

  1. FTK Imager extracts evidence

Overview shows a summary of all the data files on the disk image (includes deleted files)

2. ProDiscover Basic analyses the connected disk e.g. USB drive, shows content and cluster view depending on preferences

Create disk image on Linux:

  • DD command line

  • Dcfldd - advanced version of DD

Process for Creating Disk Image on Linux

  1. Identify partition fdisk -l

  2. Check the system file and space parted -l

  3. Create a folder and mount it on Linux file system sudo mkdir /mnt/example

  4. Mount the drive on the created folder sudo mount /dev/sdb /mnt/example

  5. Create another folder for case analysis mkdir /mnt/example/case

  6. Note the details in output file fdisk fdisk -l >/mnt/example/case/fdisk.txt

  7. Create the image, store md5 and sha256 in the selected folder dcfldd if=/dev/sdb hash=md5,sha256 hashwindow=1G md5log=/root/md5.txt sha256log=/root/sha256.txt hashcon=after conv=noerror,syncof=/root/diskimage.dd

Analyse disk image on Linux:

Autopsy analyses the disk image by showing system information, metadata information, file information.

Examine disk image on Linux:

Digital Forensics Framework in Linux uses open-source technologies. It can find hidden data, recover deleted files, analyse files and examine metadata.

First up, with 1.5hrs of learning, you can't become a professional like what they say. The content is an overview of the forensic processes and introduction to some commonly used tools. Good stepping stone to explore in-depth into Forensics!

Become Computer Forensics Expert & Start your career!