SEC400 - Information Security, Incident Response and Computer Forensics

Delivery Options Instructor-Led - Virtual

Course Description

This course provides a comprehensive overview of incident response & computer forensics. Topics include everything from establishing policies and procedures to collecting data from live Windows and Unix machines. Several hands-on exercises utilizing the HELIX Forensics CD will be incorporated into the course to allow you to perform live forensic analysis on the operating system. Tools Include: Windows Forensics Toolchest (WFT), Incident Response Collection Report (IRCR2), First Responder’s Evidence Disk (FRED), First Responder Utility (FRU), Md5 Generator, File Recovery, Rootkit Revealer and many others.

Course Outline

Introduction
- Real-World Incidents
- Incident Response Process
- Preparing for Incident Response
- Incident Response Detection
Data Collection
- Live Collections
- Forensic Duplication
- Network-Based Evidence
- Evidence Handling
Data Analysis
- Computer Storage Fundamentals
- Data Analysis
- Computer Investigations
- Network Traffic Analysis
- Hacker Tools
- Forensic Reports