Linux Forensics

Module 1: Computer Hardware

The first module will cover different components of computer hardware. Students will learn the main components of Storage-Disks, and the structure of the Linux OS.

• Drives and Disks
  • The Anatomy of a Drive
  • Data Sizes
  • Volumes & Partitions
  • Disk Partitioning and the Disk Management Tool
  • Solid State Drive (SSD) Features

• Understanding Linux-OS Structure
  • Linux Directory Structure
  • Services and systemd
  • Users and Groups
  • Understanding Shells

Module 2: Forensic Fundamentals

This module will expose students to the internal components of the Linux OS. Students will learn about tools that will help them with the Forensics investigation process.

• Understanding Hashes and Encodings
  • Hash as a Digital Signature
  • The Use of Hash for Forensics
  • Base Encodings

• Linux-OS Artifacts
  • User Activity Files
  • Physically Accessing Running Process
  • Service Logging Using Journalctl
  • Logfile Analysis
• Cracking the Shadow and Passwd Files

• Files in /dev

• SUID/SGID files

• Data and Files structure
  • Hexadecimal Editing Tools
  • File Structure
  • Embedded Metadata
  • Working with Clusters

Module 3: Collecting Evidence

Students will master techniques for collecting evidence during this module, accessing, and retrieving volatile and non-volatile information. Students will master techniques for collecting evidence, accessing, and retrieving volatile and non-volatile information.

• Forensic Data Carving
  • Using Bvi for Forensics Carving
  • Automatic File Carving Tools
  • Files with Basic System-Info and Suspicious User-Info

• Collecting Information
  • Indenting Evidence of Program Execution

Advanced knowledge of:

• Linux
• Network Forensics (Course 71586) or Windows Forensics (Course 71585)