-: Digital Forensics
In this section of the course,
we're going to talk all about digital forensics.
We're going to talk about the toolkits, the methods,
and everything else you're going to need to know
for the CSA+ exam, and how to conduct
digital forensics in the real world.
Now, this is going to be
an introduction to digital forensics,
but it will give you a great overview
as we go through this.
Digital Forensics is the science of forensics,
and it's used to determine
any kind of changes, activities, or actions
that may have occurred
on a host, server, or computer system.
This is going to allow
incident responders to determine
exactly what happened, by putting together
all of the pieces, and start figuring out
what happened in a organic method.
There are similar techniques that
are going to be used by incidents responders,
as well as by law-enforcement.
The big difference here is going to be the chain of custody.
If you're in law-enforcement,
you have to follow a specific chain of custody,
so that your digital forensic evidence
can be used in a court of law,
either in civil or in criminal investigations.
Now if you're doing this
from an incident response perspective,
that specific chain of custody
is not going to be nearly as important.
But other than that, you're going to use
a lot of the same tools and techniques,
and we're going to cover those
in this section of the course.
Documentation in digital forensics is really important,
because if you ever have to go to court later
in a civil case, your stuff can be introduced as evidence.
Now if it's going to be going into a criminal case,
it has to follow the specific chain of custody,
and law-enforcement has to be the ones who collect it.
But even so, they're going to have to
follow specific documentation.
Everything you collect needs to be documented.
You need to collect the date, and the time,
where you got the evidence,
and how you collected it.
Everything you do needs to be repeatable,
so even as you're going through your analysis,
and you're looking through those logs and those registries,
and all these other system changes,
you need to document what you did
so that if I gave that notes to a third party,
they can reproduce what you did,
and make sure that it is forensically sound.
Now again, if you're working in the law-enforcement realm,
chain of custody's going to be extremely important.
If you're doing this for an organization,
chain of custody isn't as big of a deal,
but we still tend to do it so that we can keep it,
in case we need it later on,
if we have to hand it over to law-enforcement.
Now when we talk about digital forensics,
one of the things we have to discuss in depth
is the different types of tools that we use,
so we're going to cover digital forensic toolkits
in the next lecture.
We're going to talk about
all the different components to it,
because digital forensics has so many
specialized software and hardware that you use
to conduct disk imaging of the hard drives,
follow-on analysis, and if you're doing mobile devices,
there's a entire separate set of tools
that we're going to talk about in our
Components of Mobile Forensics lab as well.
So, stick with us.
We're going to go into those right now.