◆CyberHUBBlue Team Level 1
Blue Team Level 1 domain

Digital Forensics

Evidence handling, forensic fundamentals, Windows and Linux investigations, acquisition and memory analysis.

31 lessons6 sections135 source pages
Open glossary →
31 lessons
01

Introduction to Digital Forensics

4 lessons

001Section Introduction, Digital ForensicsPDF pages 1-1001What is Digital Forensics?PDF pages 1-2002Digital Forensics ProcessPDF pages 2-3003Further Reading Material, Digital ForensicsPDF pages 3-5
02

Forensics Fundamentals

9 lessons

005Introduction to Data RepresentationPDF pages 5-12012Hard Disk Drive BasicsPDF pages 12-15015Solid State Disk Drive BasicsPDF pages 15-19019File SystemsPDF pages 19-25025Digital Evidence and HandlingPDF pages 25-28028Order of VolatilityPDF pages 28-30030Metadata and File CarvingPDF pages 30-37037Memory, Pagefile, and Hibernation FilePDF pages 37-40040Hashing and IntegrityPDF pages 40-43
03

Digital Evidence Collection

7 lessons

043EquipmentPDF pages 43-48048ACPO PrinciplesPDF pages 48-50050Chain of CustodyPDF pages 50-52052Disk Imager: FTK ImagerPDF pages 52-62063Live ForensicsPDF pages 63-64064Live Acquisition: KAPEPDF pages 64-70070Evidence DestructionPDF pages 70-74
04

Windows Investigations

4 lessons

074Windows Artifacts - BrowsersPDF pages 74-83083Windows Artifacts - ProgramsPDF pages 83-85085Windows Artifacts - Logon EventsPDF pages 85-91092Windows Artifacts - Recycle BinPDF pages 92-96
05

Linux Investigations

4 lessons

096Linux Artifacts: Passwd and ShadowPDF pages 96-98098Linux Artifacts: /Var/Lib and /Var/LogPDF pages 98-102102Linux Artifacts: User FilesPDF pages 102-113114Linux Artifacts: MemoryPDF pages 114-114
06

Memory Analysis With Volatility

3 lessons

114What is Volatility?PDF pages 114-116116Volatility WalkthroughPDF pages 116-118118Volatility 3PDF pages 118-135