Here are some additional resources that you can check out if
you want to dive a little deeper into any of the things I
mentioned throughout this course.
As with any tool, I recommend taking a look at the user documentation.
This can help illuminate new modules or capabilities that
you may have otherwise been unaware of.
The team that manages the Sleuth Kit and Autopsy do a great job of
documenting native and third‑party modules, like the experimental
Volatility one we went over earlier.
YouTube is another awesome resource I highly recommend
taking advantage of. Robert McMillen has an Autopsy series
on there that's pretty solid.
However,
I know a lot of other creators produce content that's still
within the realm of digital forensics, though may not be directly
related to the content we covered here.
Speaking of Volatility, I cannot recommend their book,
The Art of Memory Forensics, enough.
It does an excellent job of breaking down what you're looking for in memory,
why you're looking for it, and how to find it.
I know I mentioned it in the course, but if you're at all interested in
learning more about memory analysis in forensics,
this is a great starting point, and they have free labs and
memory samples available for you to practice with.
I know Andrea Fortuna also keeps a blog that details a lot of the
things that you're going to cover with Volatility.
That's also a great resource to reference too. SANS, of
course, is a staple in this field.
They have a know normal, find evil poster that comes in handy,
especially if you're trying to remember exactly which parent‑child
process relationships are normal and can really help you quickly
identify true and false positives.
They have a ton of free posters outside of that one.
I just happened to reference it quite frequently.