Operating System Forensics (2019)

1h 36mIntermediate2019-08-27

Authors

Jungwoo Ryoo

Teaches IT, cybersecurity, and risk analysis at Penn State

Course details

Criminals rely on the intricacies of operating systems like Windows, macOS, and Linux to conceal their activities and hide data. However, a skilled digital forensics expert knows the places to look and the tools to use to access evidence of their crimes. This course covers all the major concepts and tools of the growing field of operating system forensics. Instructor Jungwoo Ryoo (J.R.) reviews the fundamentals: the goals, history, and roles of operating system forensics and the future of the industry. He then shows how to acquire evidence from file systems, slack space, alternate data streams, and main memory. He uses a combination of free and commercial software, so students can practice techniques like file recovery and live acquisition with the tools that are within their budgets.

Learning objectives
Core concepts of operating system forensics
Job prospects in operating system forensics
File systems: Windows, Linux, and Mac
Acquiring data from file systems
Recovering files with data carving
Finding data in slack space
Live acquisition
Acquiring data from alternate data streams

Skills covered

WiresharkLinuxIncident ResponseCybersecurityOpen SourceDeep Dive (X:Y)

Concepts

0. Introduction

01 - Operating system forensics

1. Operating Systems and Digital Forensics

02 - Introduction
03 - History
04 - Core concepts
05 - Roles in computing
06 - Process management hands-on
07 - Roles in forensics
08 - Future

2. File System Types

09 - Introduction
10 - Windows file systems
11 - Windows hands-on
12 - Linux file systems
13 - Linux hands-on
14 - Apple file systems
15 - Apple hands-on

3. File Recovery

16 - Introduction
17 - Data carving
18 - Data carving preparation
19 - Data carving hands-on
20 - Slack space
21 - Data hiding and ADS
22 - Data hiding hands-on

4. Live Acquisition

23 - Introduction
24 - Addressing
25 - Memory structure
26 - Virtual memory
27 - Memory dump analysis with Volatility
28 - Processes
29 - Network connections

Conclusion

30 - Next steps