CYBER FORENSICS

Teacher

Sangram Routray

Category

Course Attendees

Still no participant

Course Reviews

Still no reviews

COURSE NAME: CYBER FORENSICS

CODE(CREDIT): CUTM1625(4-0-2)

COURSE  OBJECTIVE:

The aim of this course is to equip you with the knowledge and techniques to computer forensics practices and evidence analysis. It prepares you to use various forensic investigation approaches and tools necessary to start a computer forensics investigation. It also aims at increasing the knowledge and understanding in cyber security and ethical hacking.

COURSE OUTCOMES: 

 

SNO DESCRIPTION PO MAPPING
CO1 Describe how to conduct an investigation using methods of memory, operating system, network and email forensics. PO1, PO2, PO5, PO6, PO11, PO12
CO2 Identify the process in taking digital evidence PO1, PO2, PO4, PO5, PO11
CO3 Understand to the different forensics tools PO1,PO2, PO5, PO6, PO7

COURSE SYLLABUS: 

MODULE (I):                                                                                               

Digital Forensics–Understanding OS file system-Boot Process-Hard Drive architecture. Introduction to Incident response, digital forensics four-step procedure, Concepts: computer/network/Internet forensic and anti-forensics. Memory forensics.

MODULE (II):                                                                                                      

OS Forensics–Basic Windows / Linux Forensics including log analyzer-Register Viewer-Process Viewer-Browser logs review - Packet capturing - Password identification. UNIX/Linux incident response tools, UNIX/Linux file systems (Ext2/Ext3), Unix/Linux forensics investigation steps and technologies, Unix/Linux forensics case studies., Windows incident response tools, Windows file systems, Windows forensics tools, Windows acquisition, Windows forensics analysis – registry and other artifacts. 

MODULE (III):                                                                                                     

Forensic Imaging Process–Acquiring the Digital Evidence–Understanding Data Acquisition, Data Acquisition methods and Process. Disk and File System Analysis – Media Analysis Concepts – The Sleuth Kit – Portioning Disk Layouts–Special Containers – Hashing – Carving – Forensic Imaging.

MODULE (IV):                                                                                                     

Digital Forensics with Open-Source Tools–Digital Forensics–Open-Source tools–Benefits of Open-Source Tools–Open-Source Examination Platform–Preparing the Examination System–Using Linux as the host - Using Windows as the host, Loadable kernel module rootkits, Steganography hiding, detection and analysis.

TEXT BOOK:

  • Digital Forensics with Open-Source Tools by Cory Altheide, Harlan Carvey, Paperback–Import Edition, Syngress, 24 May 2011.
  • Understanding Forensic Digital Imaging by Herbert L. Blitzer, Karen Stein-Ferguson, Jeffrey Huang, 1stEdition, Academic Press, 26 July 2010.
  • The basics of Digital Forensics by John Sammons, 2nd Edition, Elsevier Publication, 2012.
  • Windows Forensics Analysis Tool kit by Harlan Carvey, 3rd Edition, Syngress Publication, 2007.

REFERENCE BOOK:

  • Cyber Forensics: A field manual for collecting, Examining, preserving evidence of computer crimes by Albert Marcella, Jr., Doug Menendez, Second Edition, CRC Press 2007.
  • Encase Computer Forensics–The Official EnCE: Encase Certified Examiner Study Guide by Steve Bunting, 3rd Edition, John Wiley & Sons Publication, 2012.
  • Man, Young Rhee, “Internet Security: Cryptographic Principles”, “Algorithms and Protocols”, Wiley Publications, 2003.
  • Nelson, Phillips, Enfinger, Steuart, “Computer Forensics and Investigations”, Cengage Learning, India Edition, 2008.

 

 

 

SESSION 01: Understanding OS file system

Understanding OS file system

SESSION 02: Boot Process

Boot Process

SESSION 03: Hard Drive architecture

Hard Drive architecture

SESSION 04: Introduction to Incident response

Introduction to Incident response

SESSION 05:digital forensics four-step procedure

digital forensics four

SESSION 06: Concepts: computer/network/Internet forensic and anti-forensics

Concepts

SESSION 07: Memory forensics.

MEMORY FORENSICS

SESSION 08:BASIC WINDOW/LINUX FORENSICS INCLUDING LOG ANALYSER

Basic Windows

SESSION 09: Register Viewer-Process Viewer-Browser logs review

Register Viewer

SESSION 10: Packet capturing - Password identification

Packet capturing

SESSION 11: UNIX/Linux incident response tools, UNIX/Linux file systems (Ext2/Ext3)

UNIX

SESSION 12: Unix/Linux forensics investigation steps and technologies, Unix/Linux forensics case studies

Unix1

SESSION 13: Windows incident response tools, Windows file systems

Windows incident response tools

SESSION 14: Windows forensics tools, Windows acquisition, Windows forensics analysis – registry and other artifacts.

Windows forensics tools

SESSION 15: Forensic Imaging Process–Acquiring the Digital Evidence

FORENSIC IMAGING

SESSION 16: Understanding Data Acquisition, Data Acquisition methods and Process.

SESSION 17:–Disk and File System Analysis 

SESSION 18:Media Analysis Concepts

SESSION 19:– The Sleuth Kit

SESSION 20:Portioning Disk Layouts

SESSION 21:Special Containers

SESSION 22:Hashing

SESSION 23:– Carving

SESSION 24:– Forensic Imaging.

SESSION 25:Digital Forensics with Open-Source Tools–Digital Forensics

SESSION 26:Open-Source tools

SESSION 27:Benefits of Open-Source Tools

SESSION 28:Open-Source Examination Platform

SESSION 29:Preparing the Examination System

SESSION 30:Using Linux as the host

SESSION 31:Using Windows as the host

SESSION 32:Loadable kernel module rootkits

SESSION 33:, Steganography hiding

SESSION 34:detection and analysis

Our Main Teachers

Sangram Routray

Assistant Professor
VIEW PROFILE