Computer forensics is used to find legal evidence in computers or storage devices. Although this course won't teach you how to become a digital forensics detective, it will cover the basics of this growing (and exciting) technical field. Author Jungwoo Ryoo reviews the basics: the goals of computer forensics, the types of investigations it's used for, a forensic investigator's typical toolset, and the legal implications of this type of work. Then he'll show how to prepare for an investigation; acquire data "live" while the system is running, statically from a hard drive, or from a remote machine; make sure data is kept in its original state with software and hardware write blockers; analyze the data; and create a report of your findings. Jungwoo uses a combination of open-source and commercial software, so you'll be able to uncover the information you need with the tools that are in your budget.
Topics include:
Understanding computer forensics
Understanding partitioning
Using a hex editor
Preparing a target drive
Acquiring data
Ensuring data integrity with hashing
Indexing and searching
Generating a report