.PNG "DFIR_ICON_(1).PNG"){kind=icon}
As the digital media world expands, SANS DFIR course FOR498 has continually evolved to keep up with the investigation demands posed by more digital devices, repositories, and colossal data sets. After four years of instructing, the course authors have decided to rebrand it from FOR498: “Battlefield Forensics & Data Acquisition” to “Digital Acquisition & Rapid Triage” to accurately reflect the newly revised content and to better reflect the content students can expect to receive.
“The FOR498 name change better aligns with what the course provides for students and further reinforces the goal to help find and properly extract the evidence that can make or break a case. After all, in most instances forensic analysts have only one chance to do this right”, says Kevin Ripa, course co-author.
The FOR498: Digital Acquisition and Rapid Triage course is designed to provide first responders, investigators, and digital forensics teams with the advanced skills to quickly and properly identify, collect, preserve, and respond to data from a wide range of storage devices and repositories.
Eric Zimmerman, course co-author, points out, “One thing has not changed in the world of data acquisition and triage; attacks require not only a thorough investigation but also one that produces evidence quickly. A lot of investigations are time sensitive, and getting to that evidence could be a matter of life or death. This is the reason we wrote this course, to provide the latest training that can get actionable intelligence fast.”
Actionable Intelligence in 90 Minutes or Less
Students who sign up for FOR498: Digital Acquisition & Rapid Triage need to get ready for a firehose of information. They will get practical experience for rapid triage and digital acquisition from hard drives, mobile phones, cloud storage, Internet of Things devices, and everything in between.
“After taking this course, students will be able to acquire data and produce actionable intelligence in 90 minutes or less. That may sound like a bold claim to traditional forensicators, but when we say you can go from seizure to actionable intelligence in that time, we mean it,” says Ripa.
The course goes over software developed by Eric Zimmerman called KAPE, which stands for Kroll Artifact Parser and Extractor. This is an efficient and highly configurable triage program that will target essentially any device or storage location, find forensically useful artifacts, and parse them within a few minutes.
“You won’t even have time to go for a cup of coffee before your data is ready!” continues Ripa.
To learn more about KAPE listen to the following SANS webcasts and videos:
- Learning about the KAPE tool - 3MinMax, a YouTube series conducted by Kevin Ripa
- Understanding and Using KAPE Target Files - 3MinMax
- Understanding and Using KAPE Module Files - 3MinMax
- Explaining the KAPE GUI Version -Target Side - 3MinMax
- Explaining the KAPE GUI Version - Module Side - 3MinMax
- Running KAPE through the GUI Version - 3MinMax
- Reviewing the Output Created by KAPE- 3MinMax
- Triage Collection and Timeline Analysis with KAPE, presentation conducted by Mari DeGrazia
- Enabling KAPE at Scale, presentation conducted by Mark Hallman
A Course Packed with the Training Investigators Need to Get the Job Done
On the first day of the six-day FOR498 course, students learn how to use several devices and data acquisition tools, including the Windows SIFT workstation. They will also learn about the various data sources and formats found today, and how to acquire and analyze smartphone data. Day two lays the foundation for evidence collection, from initial arrival on a scene to controlling it. The course also examines fundamentals of understanding data at rest and properly identifying devices, interfaces, and tools necessary for successful collection.
Next, students learn “quick-win forensics” – a rapid triage approach to prioritize, locate, extract, and process the digital evidence needed to quickly move a case forward. Nearly all the digital evidence required for a typical investigation comes from only 1 to 2 percent of the data available. Quick-win forensics teaches you the most efficient way to find and process that critical evidence.
“Having the skills to prioritize the collection and extraction of the most important artifacts from devices is becoming increasingly relevant, so it is critical that investigators have a solid basis to approach quick-win forensics. Having those skills will also differentiate you from other investigators,” says Ripa.
Students also learn how to identify and access data in nontraditional storage areas, how to acquire such data, and how to access and forensically image Apple products.
“You’ll learn the best methods to determine attribution that links data to people and explores data collection in the pervasive Internet of Things that controls household electronics, security cameras, door locks, and more,” says Zimmerman.
On the final course day, instructors will cover the techniques you can employ when traditional tools fail, including best-of-breed file carving tools, and how to perform manual data carving when even the carving tools fail.
-----
Learn more about the updated course
-----
FOR498 is co-authored and taught by certified SANS Senior Instructor Kevin Ripa and SANS Principal Instructor Eric Zimmerman, both veteran cybersecurity experts who are highly regarded in the digital investigations field. With 25 years of experience in digital forensics, Kevin has assisted in complex cyber-forensics and hacking response investigations around the world. He is sought after for his expertise in information technology investigations and frequently serves as an expert witness. Kevin is president of The Grayson Group of Companies, which consists of Computer Evidence Recovery, Inc., Pro Data Recovery Inc., and J.S. Kramer & Associates, Inc. Eric, a former FBI Special Agent, has written more than 50 programs used by thousands of law enforcement officers in over 80 countries, and has created many world-class open-source forensic tools (EZ Tools). Today, Eric serves as a Senior Director at Kroll in the company's cybersecurity and investigations practice.
Learn more about FOR498: Digital Acquisition & Rapid Triage and course training opportunities here.
