Learning Outcomes:
1. Overview of Windows Forensics
2. File System Analysis
3. Overview of Cryptography
4. Encryption and Decryption
5. Overview of Memory Forensics
6. Anti-forensic Techniques
7. Hypervisor Files and Formats
8. Forensic Analysis of a Virtual Machine
9. Overview of Cloud Forensics
10. Analysis of Cloud Applications
UNIT 1: Windows Forensics - Volatile data collection, Non-volatile data
collection, Registry Analysis, Browser Usage, Hibernate File Analysis, Crash
Dump Analysis, File System Analysis, File Metadata and Timestamp Analysis,
Event Viewer Log Analysis, MFT analysis, Timeline Creation, Evidence Collection
in Linux and Mac Operating system.
UNIT 2: Cryptography - Cryptographic System, Classification of
Cryptographic System, Secret Key, Cryptography, Cryptanalysis and Attacks,
Encryption and their types, Encryption algorithms, brute force attack, Decryption
and their types, HDD and Artifacts Encryption and Decryption Techniques.
UNIT 3: Memory Forensics - History of Memory Forensics, x86/x64
architecture, Data structures, Volatility Framework & plugins Memory acquisition,
File Formats – PE/ELF/Mach-O, Processes and process injection, Command
execution and User activity, Networking, sockets, DNS and Internet history,
shellbags, paged memory and advanced registry artifacts, Related tools – Bulk
Extractor and YARA, Timelining memory, Recovering and tracking user activity,
Recovering attacker activity from memory, Introduction to Anti-forensics, tools
and techniques.
UNIT 4: Virtual Machine Forensics - Types of Hypervisors, Hypervisor Files
and Formats, Use and Implementation of Virtual Machines in Forensic Analysis,
Use of VMware to establish working version of suspect’s machine, Networking
and virtual networks within Virtual Machine, Forensic Analysis of a Virtual
Machine (Imaging of a VM, Identification and Extraction of supporting VM files
in the host system, VM Snapshots, Mounting Image, Searching for evidence)
UNIT 5- Cloud Forensics - Introduction to Cloud Computing, Challenges
faced by Law enforcement and government agencies, Cloud Storage Forensic
Framework (Evidence Source Identification and preservation, Collection of
Evidence, Examination and analysis of collected data) Cloud Storage Forensic
Analysis. Dropbox analysis: Data remnants on user machines, Evidence source
identification and analysis, Collection of evidence from cloud storage services,
Examination and analysis of collected data.
Google Drive: Forensic analysis of Cloud storage and data remnants,
Evidence source identification and analysis - Collection of evidence from cloud
storage services, Examination and analysis of collected data, Issues in cloud
forensics. Case Studies.
Reference:
1. Window Forensic Analysis (DVD Toolkit) by Harlan Carver
2. File System Forensic Analysis by Brain Carrier
3. Windows Registry Forensics
4. Advanced Digital Forensic Analysis of the Windows Registry by Harlan Carvey
5. Cryptography and Network Security: United States Edition by William Stallings
6. Cryptography: An Introduction (3rd Edition) by Nigel Smart
7. An Introduction to Cryptography
8. Cryptography and Data Security by Dorothy Elizabeth Rob, ling Denning
9. The Art of Memory Forensics (Detecting Malware and Threats in Windows,
Linux, and
Mac Memory) Michael Hale Ligh, Andrew Case, Jamie Levy, AAron Walters
10. Advances in Memory Forensics by Fabio Pagani
11. Virtualization and Forensics A Digital Forensic Investigator’s Guide to Virtual
Environments by Diane Barrett
12. http://atkison.cs.ua.edu/papers/ACMSE11_JF.pdf
13.https://stars.library.ucf.edu/cgi/viewcontent.cgi?referer=https://
www.google.com/&httpsre dir=1&article=2790&context=etd
14. https://odr.chalmers.se/bitstream/20.500.12380/300023/1/CSE%2019-
10%20CPL%20Andersson.pdf
15. Cloud Forensics by Keyun Ruan, Joe Carthy, Tahar Kechadi, Mark Crosbie
16. Digital Forensics for Network, Internet, and Cloud Computing: A Forensic
Evidence Guide for Moving Targets and Data Paperback by Terrence V. Lillard
17. Data Collection Techniques for Forensic Investigation in Cloud by Thankaraja
Raja Sree and Somasundaram Mary Saira Bhanu
18.https://www.researchgate.net/publication/
235712413_Cloud_Forensics_A_MetaStudy_of_
Challenges_Approaches_and_OpenProblems
19. Cloud and Edge Computing-Based Computer Forensics: Challenges and Open
Problems by Vijay Prakash, Alex Williams, Lalit Garg, Claudio Savaglio and
Seema Bawa. (Research Paper)
