This is a core-level technical course for people looking to extend their digital forensic knowledge beyond conventional device analysis.

COURSE OVERVIEW

On this five-day practical course you will investigate forensic case studies, applying the principles, knowledge and techniques learnt during the course. It will help you protect your IT environment by showing you how to conduct malware analysis, from first principles all the way to investigating network activity stemming from malicious software infection that your AV software has failed to detect.

For corporate groups, we can organize this training as an on-site private group.

Prerequisites

Completion of the CFIP course is highly recommended. Otherwise you will need:

Knowledge of the principles surrounding forensic investigation and an understanding of the preliminary forensic investigation case considerations
Sound experience with the Microsoft Windows operating systems
An understanding of how a web page is requested and delivered
Ideally an understanding of Command Line Interface (CLI) and TCP/IP networking concepts

WHO SHOULD ATTEND

For those looking to develop their skills in malware identification and analysis, including:

Digital forensic analysts
Cyber incident investigators
Law Enforcement Officers
System administrators

What You Will Learn

THE SKILLS YOU WILL LEARN

Practical application of course content will be through the use of case scenarios in order to gain a practical understanding of modern malware beyond the often quoted traditional principles; mount forensic images for analysis; build virtual machines for analysis, and build a network environment to carry out network forensic analysis.

KEY BENEFITS

The course will give you:

You will learn how to identify, analyse and interpret malicious software and associated forensic artefacts, including Trojan horses, viruses, worms, backdoors and rootkits
How Trojan payloads can be used to bypass anti-virus software, personal and corporate firewalls
You will practice malware investigations from mounted, booted and network perspectives, and undertake real-world exercises, including the conversion of E01 forensic images to bootable virtual machine disks
The function, structure and operation of the Windows registry, and investigation of malicious software locations in the registry and file system
The skills to analyse and interpret malicious software, and investigate network activity initiated by malicious software infection
An understanding of how to simplify complex evidence, and collate and report results
An industry-recognised qualification in malware investigation

Training Outline

Analysis Environments

Identify and define the five analysis environments
Identify situations in which each of the investigation environments could be used effectively
Identify their respective levels of risk both to the original data as well as other systems

Malicious Software

Define the term 'malicious software'
Identify and define different types of malicious software
Identify similarities and differences between different types of malicious software

Malware Investigation

Identify the stages of malware investigation
Critically assess the capabilities and limitations of anti-malware tools
Identify the different means of running software at system start-up

Methods of Deception

Identify mechanisms of malware delivery
Identify mechanisms of disguise
Identify client security circumvention

Mounted Analysis

Mounting forensic images as logical drives
Using malware scanners against the mounted image
Documenting the results of malware scans
Using online scanners for further clarification

Booted Analysis

Identify approaches to creating a booted analysis environment
Experiment with making a Virtual Machine
Identifying password implications
Identifying and explaining the potential differences between mounted and booted analysis results

Network Analysis

Identify key reasons for network analysis
Methods of building a network for analysis
Explaining network communication protocols
Using traffic analysis tools for network analysis
External Port Analysis
Identifying and explaining the potential differences between network and other analysis results

Virtualisation Malware

Explain how hardware Hypervisor support allows for virtualisation malware
Define Type I, Type II and Type III malware

Simplifying Complex Evidence

Aiming the report at a subject knowledge level fitting the target audience
Discuss a sample report outline

Why Choose Us

Leading UK-based global training provider since 1995.

Experience Certified Malware Investigator (CMI) in Norway through Bilginç IT Academy's live and interactive virtual classroom environment. Join a Public course as an individual delegate or arrange a dedicated Private / In-house online training program exclusively for your organization.

Delivery Method: Online Instructor-Led
Participation Model: Public / Private (In-house)
Live and Interactive Training: Connect with your instructor in real time and actively participate through discussions, Q&A sessions, practical exercises, and group activities.
Flexible Participation: Join the training from your home, office, or any location with a suitable internet connection.
Expert Trainer Network: Learn from experienced trainers with strong industry backgrounds and practical field expertise.
Over 30 Years of Training Expertise: Benefit from Bilginç IT Academy's professional training experience since 1995.
Worldwide Access: Join our live virtual classrooms from Norway or anywhere else in the world, or arrange a dedicated online training program for your organization.

Experience Certified Malware Investigator (CMI) through face-to-face Classroom Based training in Norway. Training can be delivered as a Public course open to individual delegates or as a dedicated Private / In-house class for your organization.

Delivery Method: Classroom Based
Participation Model: Public / Private (In-house)
Face-to-Face Learning: Interact directly with your instructor and fellow delegates in an engaging classroom environment.
Experienced Trainers: Learn from specialists with extensive industry experience and practical real-world knowledge.
Professional Training Environment: Attend training in comfortable, well-equipped classrooms designed to support effective learning.
Practical Learning: Depending on the course, reinforce your knowledge through hands-on exercises, scenarios, case studies, and instructor-led activities.

Arrange Certified Malware Investigator (CMI) in Norway as a dedicated Onsite training program for your organization. Bilginç IT Academy trainers can deliver the training at your office or another location of your choice, with the program planned around your team's requirements and business objectives.

Delivery Method: Onsite
Participation Model: Private (In-house)
Training at Your Preferred Location: Organize the training at your company's office or another location selected by your organization.
Tailored Course Content: Adapt the training program to your projects, team structure, existing skill levels, and specific business requirements.
Team-Focused Learning: Develop your team around a shared knowledge base while strengthening internal collaboration and knowledge transfer.
Flexible Scheduling: Plan the training dates, location, and program according to your organization's operational requirements.
Worldwide Onsite Delivery: Arrange the training in Norway or at another preferred location worldwide. Bilginç IT Academy trainers can travel to your selected location to deliver the dedicated training program.

Certified Malware Investigator (CMI) Training in Norway

Prerequisites

What You Will Learn

Training Outline

Why Choose Us

Certified Malware Investigator (CMI) Training Course in Norway Schedule

Certified Malware Investigator (CMI) Training in Norway

Prerequisites

What You Will Learn

Training Outline

Why Choose Us

Online Instructor-Led Training

Classroom Based Training

Onsite Training

Certified Malware Investigator (CMI) Training Course in Norway Schedule