Course Two
This is a TWO DAY course.
Although this course includes all forensic hardware and software required, which is included in the course fee and which the students keep, it does not include a forensic workstation computer. Students are expected to provide a laptop as a forensic workstation with the following minimum specification:
- P4/Athlon, 2GHz+, 1GB RAM, 40GB hard disk, Firewire and USB
- External mouse recommended
- NOTE: Evidence Talks can supply suitable workstations on request.
This course is designed for people who have either already attended our basic course - How NOT to Damage the Evidence or who already have some background in evidence handling and incident response.
This is a moderately technical course and delegates will be expected to be confident Windows™ users with a basic understanding of the various hardware components in modern PCs
Daily Agenda
Day ONE
- 09:00 - 09:30 REGISTRATION
- Tea, coffee and biscuits
- 09:30 - 11:00
- Forensic Overview
- Components and requirements of a 1st response facility - 11:00 - 11:20 COFFEE
- Tea, coffee and biscuits - a time to chat and relax
- 11:20 - 12:45
- Investigation stages and Methodology (part 1)
- Building a documented investigation methodology - 12:45 - 13:45 LUNCH
- Lunch, refreshments and more time to reflect on what you experienced in the mornings.
- 13:45 - 15:00
- Investigation stages and Methodology (part 2)
- Building a documented investigation methodology - 15:00 - 15:20 COFFEE
- Relax and get ready for the fun of the practical session
- 15:20 - 16:45
- Introduction to the Forensic Hardware and Software
- Building, configuring and testing the Forensic Workstation - 16:45 - 17:00 Summary
Day TWO
- 09:00 - 09:30 REGISTRATION
- Tea, coffee and biscuits
- 09:30 - 11:00
- PRACTICAL: Evidence Examination - Imaging and Paperwork
- Dealing with desktops, laptops, servers - Visual Examinations
- Creating forensic images of hard disks, removable media etc - 11:00 - 11:20 COFFEE
- Tea, coffee and biscuits - a time to chat and relax
- 11:20 - 12:45
- PRACTICAL - Basic Forensic Analysis (part 1) - Basic analysis and reporting
- 12:45 - 13:45 LUNCH
- Lunch, refreshments and more time to reflect on what you experienced in the mornings.
- 13:45 - 15:00
- PRACTICAL - Basic Forensic Analysis (part 2)
- Common analysis requirements and reporting - 15:00 - 15:20 COFFEE
- Relax and get ready for the fun of the practical session
- 15:20 - 16:45
- PRACTICAL - Scenario based Forensic Analysis
- Students perform complete incident "1st response" forensic task from Imaging to Reporting - 16:45 - 17:00 Summary