Introduction to Digital Forensics & Incident Response

Overview

This course is divided into two sections, one covering incidence response (IR) and the other covering digital forensics. 

In the IR portion, students are introduced to Incident Response Methodology, based on the National Institute of Standards and Technology (NIST) Computer Security Incident Handling Guide. Each of the four primary IR lifecycle phases (preparation; detection and analysis; containment, eradication, and recovery; and post-incident activity) is addressed in detail, using example incidents to facilitate class discussions.

Students transition to malware analysis and digital forensics, which are both part of IR, for the second portion of the course, where each major digital forensics phase (evidence acquisition; evidence analysis; reporting; and expert witness testimony) is addressed. 

Students receive opportunities to apply and practice concepts taught in the course through hands-on exercises, case studies, and challenges in a CTF (capture-the-flag) atmosphere.

Prerequisites

We recommend students have a general knowledge of computer, networking, and operating system fundamentals. Some exposure to file systems and network traffic analysis is also recommended.

Outline

• Incident response overview
• Incident response phases
• Digital forensics overview
• Digital forensics evidence acquisition
• Digital forensics evidence analysis
• Digital forensics reporting