vLive FOR408 Session

!!IMPORTANT - BRING YOUR OWN LAPTOP CONFIGURED USING THESE DIRECTIONS!!

A properly configured system is required for each student participating in this course. Before coming to class, carefully read and follow these instructions exactly.

You can use any 64-bit version of Windows, MAC OSX, or Linux as your core operating system that also can install and run VMware virtualization products. You also must have 8 GB of RAM or higher for the VM to function properly in the class.

It is critical that your CPU and operating system support 64-bit so that our 64-bit guest virtual machine will run on your laptop. VMware provides a free tool for Windows and Linux that will detect whether or not your host supports 64-bit guest virtual machines. For further troubleshooting, this article also provides good instructions for Windows users to determine more about the CPU and OS capabilities. For Macs, please use this support page from Apple to determine 64-bit capability.

Please download and install VMware Workstation 10, VMware Fusion 6.0, or VMware Player 6.0 or higher versions on your system prior to class beginning. If you do not own a licensed copy of VMware Workstation or Fusion, you can download a free 30-day trial copy from VMware. VMware will send you a time-limited serial number if you register for the trial at their Web site.

MANDATORY FOR408 SYSTEM HARDWARE REQUIREMENTS:

• CPU: 64-bit Intel x64 2.0+ GHz processor or higher-based system is mandatory for this class (Important - Please Read: a 64-bit system processor is mandatory)
• 8 GB (Gigabytes) of RAM or higher is mandatory for this class (Important - Please Read: 8 GB of RAM or higher of RAM is mandatory)
• Ethernet CAT5 Networking Capability Recommended or Wireless 802.11 B/G/N
• USB 2.0 or higher Port(s)
• 200 Gigabyte Host System Hard Drive minimum
• 150 Gigabytes of Free Space on your System Hard Drive - Free Space on Hard Drive is critical.
• Students should have the capability to have Local Administrator Access within their host operating system

MANDATORY FOR408 SYSTEM SOFTWARE REQUIREMENTS:

• Host Operating System: Any version of Windows, MAC OSX, or Linux operating system that also can install and run VMware virtualization products ( VMware Workstation, VMware Fusion , or VMware Player )
• Download and install Winzip or 7Zip

PLEASE INSTALL THE FOLLOWING SOFTWARE PRIOR TO CLASS:

1. Microsoft Office (any version) w/Excel or OpenOffice w/Calc installed on your host - Note you can download Office Trial Software online (free for 60 days)
2. Install VMware Workstation 10, VMware Fusion 6.0, or VMware Player 6.0 (higher versions are ok) )
3. Download and install Winzip or 7Zip

OPTIONAL FOR408 ADDITIONAL ITEMS:

• One 3.5 inch IDE or SATA hard disk drive from:
• Hard drive purchased from EBAY or Craigslist
• Hard drive from used PC at home/work
• Note - this hard drive is used during an optional image acquisition exercise; we use the used drive for imaging only

IN SUMMARY, BEFORE YOU BEGIN THE COURSE YOU SHOULD:

1. Bring the proper system hardware (64bit/8GB Ram) and operating system configuration
2. Install VMware (Workstation, Player, or Fusion), MS Office, and 7zip

If you have additional questions about the laptop specifications, please contact laptop_prep@sans.org.

• Information technology professionals who want to learn the in-depth concepts of Windows digital forensics investigations.
• Incident response team members who need to use deep-dive digital forensics to help solve their Windows hacking cases.
• Law enforcement officers, federal agents, or detectives who want to become a deep subject-matter expert on digital forensics for Windows-based operating systems.
• Media exploitation analysts who need to master tactical exploitation and Document and Media Exploitation (DOMEX) operations on Windows-based systems used by an individual. Attendees will be able to specifically determine how individuals used a system, who they communicated with, and the files that were downloaded, edited, and deleted.
• Anyone interested in a deep understanding of Windows forensics who has a background in information systems, information security, and computers.

FOR408 is a follow-on class for those who have a foundation in and understanding of the digital forensics process and evidence acquisition. FOR408 is an intermediate course that skips over the introductory material of digital forensics. The class is good for those who are new to forensics or advanced analysts, but who do not want to spend a day on basic and core digital forensic concepts and techniques. We move quickly into the analysis of Windows and spend most of our time analyzing Windows artifacts in the class.

Certifications

• Windows 8.1 version of the SIFT Workstation Virtual Machine with over 150 commercial, open source and freeware Digital Forensics and Incident Response tools prebuilt into the environment
• Windows 8.1 Standard License and Key for the Windows SIFT Workstation
• Full license to:
• AccessData FTK for a three-month trial
• Full license to MagnetForensics Internet Evidence Finder for a 15-day trial
• TZWorks Toolset for a three-month trial
• NUIX for a month trial
• 64 GB USB Key with four full real-world cases to examine during and after class
• 64 GB USB Key with four full real-world cases to examine during and after class
• Windows 8.1
• Windows 7
• Windows Vista
• Windows XP
• SANS exercise workbook with detailed step-by-step instructions
• Wiebetech Ultradock v5 Write Blocker Kit
• IDE and SATA Cable Connector
• Three FireWire Ports
• USB 3.0 Port

• Perform proper Windows forensic analysis by applying key techniques focusing on Windows 7/8/8.1
• Use full-scale forensic tools and analysis methods to detail nearly every action a suspect accomplished on a Windows system, including who placed an artifact on the system and how, program execution, file/folder opening, geo-location, browser history, profile USB device usage, and more
• Uncover the exact time that a specific user last executed a program through Registry and Windows artifact analysis, and understand how this information can be used to prove intent in cases such as intellectual property theft, hacker-breached systems, and traditional crimes
• Determine the number of times files have been opened by a suspect through browser forensics, shortcut file analysis (LNK), e-mail analysis, and Windows Registry parsing
• Use automated analysis techniques via AccessData's Forensic ToolKit (FTK), Nuix, and Internet Evidence Finder (IEF)
• Identify keywords searched by a specific user on a Windows system in order to pinpoint the files and information that the suspect was interested in finding and accomplish detailed damage assessments
• Use Windows shellbags analysis tools to articulate every folder and directory that a user opened up while browsing local, removable, and network drives
• Determine each time a unique and specific USB device was attached to the Windows system, the files and folders that were accessed on it, and who plugged it in by parsing key Windows artifacts such as the Registry and log files
• Learn event log analysis techniques and use them to determine when and how users logged into a Windows system, whether via a remote session, at the keyboard, or simply by unlocking a screensaver
• Determine where a crime was committed using Registry data to pinpoint the geo-location of a system by examining connected networks and wireless access points
• Use free browser forensic tools to perform detailed Web browser analysis, parse raw SQLite and ESE databases, and leverage session recovery artifacts and flash cookies to identify the Web activity of suspects, even if privacy cleaners and in-private browsing are used.

Course Review: SANS FOR408 Windows Forensic Analysis http://www.ethicalhacker.net/content/view/459/24/

Course and GIAC Cert Review: http://hackingexposedcomputerforensicsblog.blogspot.com/2014/02/daily-blog-226-look-ma-im-gcfe.html

"The SANS Institute is currently the leader in the commercial IR and computer forensic training market. They have a large number of quality courses." - Luttgens, Jason; Pepe, Matthew; Mandia, Kevin. Incident Response & Computer Forensics, Third Edition - July 2014

"This is a very high-intensity course with extremely current course material that is not available anywhere else in my experience." - Alexander Applegate, Auburn University

"Best forensics class I have had yet (and pretty much the only one that gives you some sort of framework on HOW to attack an exam)." - Det. Juan C. Marquez, Prince William County, Virginia Police Department

"Hands down the BEST forensics class EVER!! Blew my mind at least once a day for 6 days!" - Jason Jones, USAF

"I took SANS FOR408 Windows Forensics and the learning opportunity was second to none. Anyone looking for a first-rate forensics class that you can immediately take back to the real world and apply to their job needs to take at least one class from SANS in their lifetime. Whatever the cost may be to you, if forensics is a career priority to you, then you need to take at least one forensics class from SANS." - Chris Nowell, Information Security Architect, Airlines Reporting Corporation

"As a member of the IR team, this course will aid in investing compromised hosts." - Mike Piclher, URS Corp.

"FOR408 is based on real scenarios that are likely to occur again. The most up-to-date training I have received." - Martin Heyde, UK Ministry of Defence

"Best forensics course I have taken to date. Vast amounts of information." - Ellen Clark, FBI

"Call me a geek, but this is FUN!" - Frank Dixon, The Babcock & Wilcox Company

"Overall the course continues to be chock full of megalicious forensicness. Thanks a bunch for the key knowledge." - Vincent Bryant, Blue Cross Blue Shield of Tennessee

"If you were not interested in forensics before, you will be after this class. For those who already love it, it is reassurance that you are doing the right thing with your life." - Cleora Madison, Walt Disney Theme Parks and Resorts

"The Registry labs are invaluable. I learned more in this class about registry than in 10 years at work. Thanks!" - Michael Mimo, JP Morgan

"I was really looking forward to Windows in-depth and that is exactly what we are getting!" - Joshua Hoover, Charles Schwab

"I have been using forensics tools for years. I never professed to know it all; however, I did not expect to learn as much as I did." - Jody Hawkins, Cook ChildrenâÂÂs Health Care System

"I really appreciate the prebuilt and configured SIFT workstation. The FOR408 class materials and instruction were outstanding." - Clint Modesitt, LSUHSC

"FOR408 is absolutely necessary for any computer forensic type career. Excellent information!" - Rebecca Passmore, FBI

"Before I arrived here, I knew the basics of comp. forensics. After taking this course I feel that if suited with the proper tools, I could handle the task of working a live case" - Anonymous

"This course was by far the most informative and well taught class I have attended." - Brian Periera, Farfield PD

"Love the amount of detail/info in books, love the VM." - Jeff Datzman, Vacaville Police Department