ICSI | CDFE Certified Digital Forensics Examiner (subscription)

ICSI | CDFE Certified Digital Forensics Examiner

Course Overview

This course provides a holistic view of how Digital Forensics is implemented in the real world, including Incident Response preparation, acquiring and analyzing digital forensic images and analyzing host and network data. Malware analysis, Threat intelligence and report creation are also included.

100% online course - Study anywhere, anytime – all you need is a reliable internet connection
NCSC Certified Training, University of Central Lancashire Accredited Training Course
20 Credits MSc Cybersecurity
Course Duration: 40 Hours
24-hr remote access to a virtual lab allows you to learn, train and practice your skills in your own time.
Level: Intermediate

20 CREDITS MSc CYBERSECURITY

Course curriculum

1. Introduction
1. CDFE Lab
1. What is Incident Response
2. The Incident Response Process Model
3. The Role of Digital Forensics
4. Why Incident Response is needed
5. The Incident Response Framework
6. The CSIRT Response Charter
7. The Incident Response Team
8. The Incident Response Plan
9. Incident Classification
10. The Incident Response Playbook
11. Escalation Procedures
12. Incident Response Capability Maintenance
13. Quiz
1. Digital Forensic Fundamentals
2. UK Laws and Regulations
3. Digital Forensic Process
4. Forensics Lab
5. Quiz
1. Collection of Network Evidence
2. Preparation
3. Evidence from Network Devices
4. Collection of Evidence
5. Quiz
1. Capturing Evidence from Host Systems
2. Methods for Acquiring Evidence
3. Procedures for Collecting Evidence
4. Acquiring Memory
5. Guided Exercise: Acquiring Memory with FTK Imager
6. Guided Exercise: Acquiring Memory with WinPmem
7. Acquiring Memory Remotely
8. Virtual Machines Captures
9. Non-Volatile Data
10. Guided Exercise: Capturing Registry and Logs using FTK Imager
11. Quiz
1. Forensic Imaging
2. Forensic Imaging Overview
3. Evidence Drive Preparation
4. Guided Exercise: Drive Wiping with Eraser
5. Guided Exercise: Encrypting a Drive’s Repository Partition with VeraCrypt
6. Dead Imaging
7. Guided Exercise: Create a Forensic Image with a GUI Tool
8. Guided Exercise: Create a Forensic Image with a CLI Tool
9. Live Imaging
10. Guided Exercise: Creating a Live Image using FTK Imager Lite
11. Lab: Forensic Imaging
12. Lab: Forensic Imaging (Solution)
1. Analysing Network Evidence
2. Wireshark
3. Guided Exercise: Network Traffic Identification: PING
4. Guided Exercise: Network Traffic Identification: PING (Solution)
5. Guided Exercise: Network Traffic Identification: DNS Query
6. Guided Exercise: Network Traffic Identification: DNS Query (Solution)
7. Guided Exercise: Network traffic Identification: TCP Three-Way Handshake
8. Guided Exercise: Network traffic Identification: TCP Three-Way Handshake (Solution)
9. Guided Exercise: Traffic Analysis: Host Footprinting / File Extractions
10. Guided Exercise: Traffic Analysis: Host Footprinting / File Extractions (Solution)
11. Lab: Analysing Network Evidence
12. Lab: Analysing Network Evidence (Solution)
1. Analysis of System Memory
2. Memory Analysis Methodology
3. Guided Exercise: Analysis of Memory File Using Volatility
4. Lab: Analysis of System Memory
5. Lab: Analysis of System Memory (Solution)
1. Analysis of System Storage
2. Types of System Storage
3. File Systems
4. Commercial Tools
5. Must Have Tools for Incident Responders
6. File Carving
7. Guided Exercise: File Carving
8. Guided Exercise: File Carving (Solution)
9. Email Analysis
10. Guided Exercise: Email Header Analysis
11. Guided Exercise: Email Header Analysis (Solution)
12. Registry Analysis
13. Guided Exercise: Reading Offline Files with Regedit
14. Guided Exercise: Reading Offline Files with Regedit (Solution)
15. Guided Exercise: Reading Offline Registry Files with Windows Registry Recovery
16. Guided Exercise: Reading Offline Files with RegRipper
17. Guided Exercise: Reading Offline Files with RegRipper (Solution)
18. Hashing
19. Guided Exercise: Hashing Folders and Their Contents for Comparison
20. Guided Exercise: Hashing Folders and Their Contents for Comparison (Solution)
21. Guided Exercise: Hashing Individual Files for Comparison
22. Guided Exercise: Hashing Individual Files for Comparison (Solution)
23. Guided Exercise: Hashing Evidence Files for Validation
24. Guided Exercise: Hashing Evidence Files for Validation (Solution)
25. Web Browser Analysis
26. Guided Exercise: Analysing Chrome Internet Cache and History
27. Guided Exercise: Analysing Chrome Internet Cache and History (Solution)
28. File Analysis
29. Guided Exercise: File Analysis - Microsoft Office Files
30. Guided Exercise: File Analysis - Microsoft Office Files (Solution)
31. Guided Exercise: File Analysis - EXIF Data from Graphic Files
32. Guided Exercise: File Analysis - EXIF Data from Graphic Files (Solution)
33. Timestamps and Timeline Analysis
34. Guided Exercise: Combining Timestamps for a Timeline
35. Guided Exercise: Combining Timestamps for a Timeline (Solution)
36. Event Log Analysis
37. Guided Exercise: Examining Event Logs
38. Shortcut Files and Jump List Analysis
39. Guided Exercise: Shortcut File Analysis
40. Guided Exercise: Shortcut File Analysis (Solution)
41. Guided Exercise: Jump List Analysis
42. Guided Exercise: Jump List Analysis (Solution)
43. Prefetch File Analysis
44. Guided Exercise: Prefetch File Analysis
45. Guided Exercise: Prefetch File Analysis (Solution)
46. Thumbnail Caches Analysis
47. Guided Exercise: Analysing Thumbs.db from Windows XP
48. Guided Exercise: Analysing Thumbs.db from Windows XP (Solution)
49. Guided Exercise: Analysing Cache Images within Microsoft Files
50. GREP Searches
51. Guided Exercise: GREP Searching Through Log Files
52. Guided Exercise: GREP Searching Through Log Files (Solution)
53. File Recovery
54. Guided Exercise: Mounting a Forensic Image with FTK Imager and Recovering Files
55. Guided Exercise: Recovering Files from Forensic Images with Autopsy
56. Recovering Passwords
57. Guided Exercise: Recovering Passwords
58. Guided Exercise: Recovering Passwords (Solution)
1. Creating Forensic Reports
2. What should be documented
3. Documentation Types
4. Sources to Include
5. Audience
6. Tracking Incidents
7. Written Reports
8. Quiz
1. Malware Analysis
2. Malware Types and Definition
3. Malware Analysis Methodology
4. Guided Exercise: Performing Static Analysis
5. Guided Exercise: Performing Dynamic Analysis
6. Lab: Malware Analysis
7. Lab: Malware Analysis (Solution)
1. Threat Intelligence
2. Threat Intelligence Actor Groups
3. Advanced Persistent Threat
4. Types of Threat Intelligence
5. Threat Intelligence Life Cycle
6. Sourcing Threat Intelligence
7. Threat Intelligence Platforms
8. Threat Intelligence Use Types
9. Guided Exercise: Hashing Evidence - Known Bad Hashes
10. Guided Exercise: Hashing Evidence - Known Bad Hashes (Solution)
11. Quiz
1. CDFE Mock Exam
1. Appendix 1 - Sample Chain of Custody Form
2. Appendix 2- Host Evidence Collection Checklist
1. Exam Information
1. CDFE Course Evaluation

About this course

Free
154 lessons
0 hours of video content

Watch Intro Video

File Recovery

What is included in this course

High-quality videos with in-depth content
Modular structure – student-directed path
Knowledge Checks at end of each module and the course
Lab Guide including video Guided Exercises and answer files
24x7 remote access to a virtual lab

ICSI | CDFE Certified Digital Forensics Examiner

Course Overview

Course curriculum

Course: Digital Forensics, Incident Response and Threat Hunting

CDFE Lab

Module 1: Incident Response

Module 2: Digital Forensic Fundamentals

Module 3: Collection of Network Evidence

Module 4: Capturing Evidence from Host Systems

Module 5: Forensic Imaging

Module 6: Analysing Network Evidence

Module 7: Analysis of System Memory

Module 8: Analysis of System Storage

Module 9: Creating Forensic Reports

Module 10: Malware Analysis

Module 11: Threat Intelligence

Module 12: CDFE Mock Exam

Module 13: Appendices

Exam Information

Course Evaluation

About this course

File Recovery

What is included in this course