UCD CCI Forensics Summer School Timetable

• Overview of the general digital investigation process
• What is a standard operating procedure?
• Designing a standard operating procedure

• Need for Effective Case Management
• Open-Source Solutions
• CCIU Case Study
• Demonstration of CCIU Solution

• Configuring Networking under Linux
• DHCP and Manual config
• Setting up NFS
• Connecting to NFS Server
• Practical Exercises

• What is Linux? OS vs Kernel?
• Navigating the filesystem
• Basic Commands
• Hashing

• Physical Disks
• Partitions / Clusters / Sectors

Preliminary Analysis (Introduction to Deepthought)

• Overview of functionality
• Background
• Effectiveness

• Using Deepthought for Preliminary Analysis

• Forensic Imaging
• dd vs guymager
• Using Guymager
• Practical Exercises

• Identifying relevant artefacts
• Recovering Relevant Artefacts
• Keyword Searching
• SQLITE3

• What is Data Carving?
• File Signatures
• The file command
• Carving using Photorec
• Other Carving Tools

• What is a framework?
• Example Frameworks
• Installation of the Digital Forensic Framework
• Adding Modules to the framework

• Overview of backup strategies
• Considerations about data: redundancy vs. speed
• Building a redundant storage cluster with low-cost machines

• What is a processing cluster?
• Clustering methods and benefits
• Demo on simple cluster construction
• Demo on distributing forensic processes to the cluster

ANT – (Automated Network Triage)

• What is triage?
• Network Triage Basics
• Using ANT

• Validating tools for forensic soundness
• Measuring performance of tools and forensic processes over time