FOR498: Digital Acquisition and Rapid Triage™ CURRICULUM: DFIR & Threat Hunting 6 Day Program You Will Be Able To ▐ Collect data from PCs, Macs, tablets, smartphones, RAM, virtual machines, and cloud environments ▐ Perform evidence acquisition while maintaining forensic soundness and chain of custody ▐ Execute rapid triage workflows to generate actionable intelligence in 90 minutes or less ▐ Capture volatile data and memory from live systems during active investigations ▐ Manage scenes efficiently to preserve and prioritize critical data ▐ Acquire evidence from enterprise environments including Exchange, SharePoint, and network repositories ▐ Utilize industry-standard open-source tools and SANS-provided environments for hands-on collection and analysis Who Should Attend ▐ Federal agents and law enforcement personnel ▐ First responders ▐ Digital forensic analysts ▐ Information security professionals ▐ Incident response team members ▐ Media exploitation analysts ▐ Department of Defense and intelligence community professionals ▐ Anyone interested in an understanding of the proper preservation of systems and who has a background in information systems, information security, and computers NICE Framework Work Roles ▐ Cyber Crime Investigator (OPM 221) ▐ Cyber Defense Forensics Analyst (OPM 212) 36 CPEs 20 Labs GBFA giac.org/gbfa Battlefield Forensics and Acquisition The clock is ticking. You need to prioritize the most valuable evidence for processing. Let us show you how! FOR498,™ a digital forensic acquisition training course, provides the necessary skills to identify the many and varied data storage mediums in use today, and how to collect and preserve this data in a forensically sound manner despite how and where it may be stored. It covers digital acquisition from computers, portable devices, networks, and the cloud. It then teaches the student rapid triage, or the art and science of identifying and starting to extract actionable intelligence from a hard drive in 90 minutes or less. FOR498 Will Help You To: ▐ Acquire data effectively from: • PCs, Microsoft Surface, and Tablet PCs • Apple Devices, and Mac, and Macbooks • Random Access Memory (RAM) • Smartphones and portable mobile devices • Cloud storage and services • Network storage repositories • Virtual Machine environments ▐ Produce actionable intelligence in 90 minutes or less Syllabus Summary SECTION 1: Introduction, Basic Concepts, and Device Identification SECTION 2: Online Asset Ownership, Scene Management, File Systems, Memory Acquisition, and Encryption Detection SECTION 3: Triage and Data Acquisition SECTION 4: Dead Box Acquisition, Virtual Machines, and Apple Preparation SECTION 5: Apple Acquisition, Data Carving, and Remote Acquisition SECTION 6: Portable Device Acquisition, Analysis, and the Internet of Things “ FOR498 provides a solid foundation for the new forensicator with regards to evidence acquisition and triage! The labs provide a great variety of opportunity to tackle the most basic and complex data acquisition scenarios.” —Chris G., U.S. Federal Dept. For detailed course description, visit SANS.ORG/FOR498 Kevin Ripa Course Author Eric Zimmerman Course Author In-Person WAYS TO TAKE FOR498 Live Online OnDemand