Black Hat Europe Training 2005
Grand Hotel Krasnapolsky • March 29-30

Overview
As the number of IT security incidents increases month upon month, the need for effective digital investigation techniques grows. This course teaches students how to conduct a successful digital forensic investigation, and builds a solid base of knowledge for further learning. Using a task-oriented approach, students will learn digital forensic analysis techniques and methodologies which can be applied immediately. During the course, strong emphasis is placed on technical understanding and skills.

The core curriculum of the course revolves around multiple File System Intensive sessions, focusing on file systems used on both Windows and UNIX/Linux platforms such as NTFS and Ext2FS. These File System Intensives use a combination of lectures and task-oriented hands-on lab exercises to instruct and reinforce the deep, low-level, file system knowledge crucial for effective digital forensic analysis and investigations. The lab exercises will teach core skills, such as how to:

• seize and preserve digital media
• recover deleted files (both manually and with tools)
• uncover evidence of tampering
• build a time-line

Each File System Intensive concludes with a sample investigation, reinforcing the skills developed within the course and building an understanding of how to successfully conduct a real investigation.

During the File System Intensive sessions, students will learn about the forensic analysis process, as well as the techniques and methodologies necessary for successful digital forensic investigations.

Prerequisites
Students should be comfortable using Linux as an operating environment. Students must supply their own laptop with a CD Drive, Linux installation, including X windows. This installation can be either native, or in VMware. The Linux installation must have at least 300 mb of free space. Development tools (e.g. gcc, make, etc.) must be installed on the laptop, however no development experience is required. All tools will be provide on CD-ROM.

The Grugq has been at the forefront of forensic research for the last six years, during which he has been pioneering in the realm of anti-forensic research and development. During this time, he has also worked with a leading IT security consultancy and been employed at a major financial institution. Most recently he has been involved with an innovative security software development start-up company. Currently the Grugq is a freelance forensic and IT security consultant. While not on engagements, the Grugq continues his research on security, forensics and beer.