Advanced Forensic Analysis and Incident Response

This course will teach you how to set up a complete forensic analysis procedure in heterogeneous environments. You will approach incident response from an organizational perspective. You will also study the appropriate methodologies and tools used in the technical phase of incident response, namely forensic analysis (or post-incident). At the end of the training, you will be able to preserve digital evidence for subsequent analysis and present it in the context of legal proceedings.

Specific objectives:

• Be able to define and implement a rigorous incident response process
• Properly collect the necessary evidence for quality analysis and potential legal action

• Good general IT knowledge

• Code: AIARI
• Duration: 3 days
• Hours: 8:30 AM - 5:30 PM
• Location: Training Center, North Urban Center, Tunis

• IT professionals in charge of information system security, incident response, or legal investigation

• Course material
• 40% demonstration
• 40% theory
• 20% practical exercises

• Day 1: Fundamentals of Incident Response and Forensic Analysis
  • Setting up incident response
  • Preparing for incident response
  • Detection and analysis
  • Classification and prioritization
  • Notification
  • Containment
  • Forensic investigation
  • Eradication and recovery
  • Forensic analysis and French legislation
  • Methodology and tools for forensic analysis
    • Organizing
    • Choosing your tools
    • Following scientific methods
    • Presenting conclusions in a report
• Day 2: Approach to Forensic Analysis in Key Technical Areas
  • Data collection and duplication
  • Understanding Windows, Linux, and BSD file systems
  • Outils et moyens de collecte
  • Recovering deleted partitions and files
  • Network attack analysis
    • Capture sources
    • Review of common attacks
  • Memory dump recovery and analysis (Volatility)
• Day 3: Targeted Analysis and Advanced Exercises
  • Log file analysis and event correlation
    • Manual approach
    • Using an indexer (ELK)
  • Browser forensic analysis
  • Email forensic analysis
  • Practical application on real cases