This course provides a comprehensive overview of incident response & computer forensics. Topics include everything from establishing policies and procedures to collecting data from live Windows and Unix machines. Several hands-on exercises utilizing the HELIX Forensics CD will be incorporated into the course to allow you to perform live forensic analysis on the operating system. Tools Include: Windows Forensics Toolchest (WFT), Incident Response Collection Report (IRCR2), First Responder's Evidence Disk (FRED), First Responder Utility (FRU), Md5 Generator, File Recovery, Rootkit Revealer and many others.
Learning Objectives
- Establishing policies and procedures to collecting data from live Windows and Unix machines
- Utilizing the HELIX Forensics CD will be incorporated into the course to allow you to perform live forensic analysis on the operating system
Framework Connections
Specialty Areas
- Data Administration
- Cybersecurity Management
- Systems Architecture
Feedback
If you would like to provide feedback for this course, please e-mail the NICCS SO at NICCS@hq.dhs.gov.