Digital forensics is the application of scientific investigatory techniques to digital crimes and attacks. The fundamentals of digital forensics are often not known, or overlooked during an incident and important evidence can easily be overwritten and lost. Shanna is a long term digital forensics practitioner with years of experience and stories to share on what to do, and what not to do.

During this workshop you will be introduced to the fundamentals of digital forensics, including artefact collection, preservation and analysis. Participants will learn how to start a digital investigation using open source or freely available tools to demonstrate the theory and challenges will be provided to participants to practice along.

We'll utilise freely available CTF questions and evidence to make it accessible for all, and provide a jump start on how to get involved in DFIR challenges and events. Mostly we want to provide a way to get started with DFIR and get you hooked too.

Training Outline:

Module 1 - Introductions to the teachers and the outline of the day and what they will learn and how.
Module 2 - The what and why of digital forensics. What is digital forensics, the history, the process, the different types of digital forensics, all about what evidence is and chain of custody.
Module 3 - The how: Mounting an image, what is the NTFS file system, collecting and parsing artefacts related to the file system, registry, event logs and browser history.
Practical component - we will demonstrate along the way in each module how to gather the evidence and parse it and answer the relevant CTF questions showing the participants how to complete each question.

Key Takeaways:

At the end of this training, the attendees will be have:

an understanding of the digital forensics process,
what tools are available to use and for what, and
how to get started with DFIR CTFs.