We can host this training at your preferred location. Contact us!

This specialist-level course is for experienced forensic investigators who want to acquire the knowledge and skills to navigate, identify, capture and examine data from Linux-based systems.

COURSE OVERVIEW

Linux is an increasingly popular operating system. This two-day course will provide you with a practical understanding from a forensic perspective of how to deal with a Linux system, and requires no previous Linux knowledge. You will develop a core understanding of the file system data structures and key files so that they can be confident in capturing potential digital evidence. Throughout the course you will apply this knowledge in hands-on exercises to demonstrate and reinforce understanding, using both a Linux environment and Windows based forensic software.

Completion of the 7Safe CFIP course is highly recommended. Alternatively you will need an understanding of digital forensic principles and practices. No Linux experience is necessary.

Who Should Attend?

Forensic practitioners
Systems administrators
Cyber investigators who want to extend their experience from Window-based systems to the Linux environment.

THE SKILLS YOU WILL LEARN

Upon completion of the course you will have used a Linux System to:

Become familiar with both Linux GUI and command line environments.
Demonstrate how Linux can be used for forensic imaging.
Capture RAM and basic volatile data from a live Linux system. (Note: This is not network identification or network traffic capture)

and Windows based forensic software and an image of a Linux system to:

Examine ext3 and ext4 file system structures
Identify core system information
Explore system log files for artefacts including; boots, logins and device connection
Examine user artefacts including; recent activity, thumbnails and printing.

KEY BENEFITS

On this course, you will:

Understand the data structures associated with the ‘ext’ file systems
Learn effective techniques to extract data from a Linux environment
Develop confidence when identifying and capturing Linux system artefacts
Improve your ability to respond effectively to a wider range of forensic incidents

SYLLABUS

What is Linux? Overview of flavours (distributions)
Key differences between Linux and Windows forensics
Linux concepts, privileges and permissions
Linux disk layouts and key directories
Navigating a Linux system and commonly used command line utilities
Understanding devices and disk mounting
Data collection from and using Linux systems
Capturing volatile data including RAM
Built-in forensic applications i.e dd for imaging and disk wiping
Overview of file system compatibility, ext2, 3 and 4
Ext file systems How disks are mapped and data stored
Problems associated with recovering data from ext file systems
System information from a forensic image
Log files, where to find them and nature of content
Devices connected and disks mounted
User accounts – identification, passwords and permissions
Introduction to memory analysis
User system navigation, execution and printing
Linux in Business - FTP servers, databases, mail, web-servers
Capturing and process for log file examination using Linux

Upcoming Trainings

Join our public courses in our United Kingdom facilities. Private class trainings will be organized at the location of your preference, according to your schedule.

Classroom / Virtual Classroom

11 November 2024