Certified Linux Forensic Practitioner (CLFP) Training in United States of America

This specialist-level course is for experienced forensic investigators who want to acquire the knowledge and skills to navigate, identify, capture and examine data from Linux-based systems.

COURSE OVERVIEW

Linux is an increasingly popular operating system. This two-day course will provide you with a practical understanding from a forensic perspective of how to deal with a Linux system, and requires no previous Linux knowledge. You will develop a core understanding of the file system data structures and key files so that they can be confident in capturing potential digital evidence. Throughout the course you will apply this knowledge in hands-on exercises to demonstrate and reinforce understanding, using both a Linux environment and Windows based forensic software.

Completion of the 7Safe CFIP course is highly recommended. Alternatively you will need an understanding of digital forensic principles and practices. No Linux experience is necessary.

Who Should Attend?

• Forensic practitioners

• Systems administrators

• Cyber investigators who want to extend their experience from Window-based systems to the Linux environment.

THE SKILLS YOU WILL LEARN

Upon completion of the course you will have used a Linux System to:

• Become familiar with both Linux GUI and command line environments.
• Demonstrate how Linux can be used for forensic imaging.
• Capture RAM and basic volatile data from a live Linux system. (Note: This is not network identification or network traffic capture)

and Windows based forensic software and an image of a Linux system to:

• Examine ext3 and ext4 file system structures
• Identify core system information
• Explore system log files for artefacts including; boots, logins and device connection
• Examine user artefacts including; recent activity, thumbnails and printing.

KEY BENEFITS

On this course, you will:

• Understand the data structures associated with the ‘ext’ file systems
• Learn effective techniques to extract data from a Linux environment
• Develop confidence when identifying and capturing Linux system artefacts
• Improve your ability to respond effectively to a wider range of forensic incidents

SYLLABUS