National CAE Designated Institution
  • Online, Instructor-Led
Course Description

Many digital investigations require an understanding of where operating systems store information. Forensic practitioners need to understand the analysis of the three major operating systems they may encounter in a real world analysis. Topics covered will include memory acquisition and analysis, timeline investigation, configuration settings including the Windows registry and tracking information that is stored within operating system settings. The course will cover Windows, Mac OS X and Linux investigations and artifacts.

Learning Objectives

  • Apply appropriate digital investigations practices to the acquisition and interpretation of operating system artifacts
  • Compare different forensics tools that would be used to gather operating system artifacts
  • Analyze information storage locations used by the operating system to gather potential evidence
  • Inspect volatile memory and analyze memory captures for potential evidence

Framework Connections

The materials within this course focus on the NICE Framework Task, Knowledge, and Skill statements identified within the indicated NICE Framework component(s):

Specialty Areas

  • Network Services
  • Vulnerability Assessment and Management
  • Digital Forensics
  • Cyber Investigation
  • Collection Operations

Specialty Areas have been removed from the NICE Framework. With the recent release of the new NICE Framework data, updates to courses are underway. Until this course can be updated, this historical information is provided to give better context as to how it can help you with your cybersecurity goals.