>> Hey everyone, welcome to the computer
hacking you forensics course.
My name is Ken Underhill.
I will be your instructor
>> and we'll talk about who I am in just a little bit.
>> Let's talk about what we're going to
learn in this particular course.
In Module 1, we're going to talk
about computer forensics today.
We'll talk about things like,
different laws that are applicable.
Select the 4th Amendment,
things like HIPAA and FISMA,
and don't worry about it
>> if you don't know what those stand for,
>> we'll talk about those.
>> In Module 2, we're going to talk about
>> the forensic process.
>> We're going to talk about things
like the pre-investigation phase,
the investigation phase, the post-investigation phase.
Like what do you do as an investigator?
Module 3, we'll talk about hard disks and file systems.
We're going to take a high-level overview,
but we'll talk about different file systems like FAT,
NTFS, EXT, etc.
Again, don't worry about
>> if you don't know what those stand for
>> and we'll talk about those in that module.
>> Module 4, we'll talk about data acquisition.
We're going to talk about Live.
>> We're also going to talk
>> about volatile and nonvolatile data,
and one common thing that we'll talk about
>> throughout the entire course is going to
>> be something called the chain of custody.
You'll find out what that is
>> and we'll reference it throughout the entire course.
>> Module 5, we have anti-forensics,
so we're going to understand basically
>> why are the bad people trying to do
>> anti-forensics against us as investigators
>> and what the purpose is.
>> Module 6, we'll have operating system forensics,
so we'll touch on different file path information
>> in the operating system as well as
>> some information about Windows registry
>> because you may see Windows registry tested
>> somewhat on the exam.
>> Module 7, we have network forensics
>> and we'll take a high-level overview
>> and talk about some important aspects of
>> how we can actually use our network forensic log,
so how it's admissible in a court of law.
We'll talk about the hearsay federal rules of evidence.
Module 8, we have web attack investigations,
so we'll talk about different things
like the web application architecture,
things that might indicate a web attack.
Then we'll talk about also some web attacks
that are common like cross-site scripting
and SQL injection.
Module 9, we're going to have database forensics.
We'll talk about things like MS SQL,
data storage and the SQL Server, etc.
Anything related to databases
that you would probably need to know for your exam,
we'll cover in that module.
Module 10, we cover forensics in the Cloud.
Here we're just going to talk about
the different types of Cloud computing,
separation of responsibilities and Cloud environment.
Cloud as a subject, Cloud as an object, etc.
You'll understand what all those mean
>> and those are going to be
>> very important for the CHFI exam.
>> Module 11, we've talked about good old malware.
We're just going to talk about different ways
of malware can interrupt system.
We'll talk about some tools that can be used
>> for a dynamic and static analysis.
>> Again, I want to stress
>> that's not a deep dive into malware analysis
>> where it's going to take very high level approach.
>> Module 12, email.
We're going to be talking about email investigation.
We'll talk about where exchange server,
the file types of storing as,
which will be important for your exam.
We're also going to talk about things
>> like the CAN-SPAM Act,
>> if you're not familiar with.
>> Module 13, we'll go over mobile.
We'll talk about mobile forensics,
mobile architectures, mobile storage.
We'll talk about things like SIM, ICCID, IMEI, eSIM.
Again, a bunch of little acronyms there.
But we'll talk about what those actually
mean for the exam because
>> you will want to know mobile
>> from a significant standpoint for the CHFI exam.
>> Then finally in Module 14,
we're going to wrap things up with forensic reporting.
We'll talk about some of the components
>> that you'll need in a report.
>> We'll talk about depositions,
we'll talk about Daubert versus Frye standards.
A lot of good information in there
>> that you may see tested on CHFI exam.
>> Who am I?
>> Why am I even qualified to teach you?
>> My name is Ken Underhill, as I mentioned.
I'm a certified ethical hackers,
walls and computer hacking forensic investigator.
Again, both those certs are through EC council.
I'm also a Master Instructor here at Cybrary,
also an Agent Professor of Digital Forensics.
I walk the walk so to speak.
CHFI, I do write exam questions,
so I haven't written it for the Version 9,
I wrote them for the next version
>> that'll be coming out.
>> I'm actually hoping that some of my questions
>> will be on the exam.
>> Then I can pat myself on the back a little bit.
Then also for the CEH exam,
I am one of the people that
I did review the newer content.
For example, most people are
calling it Version 10 of the CEH.
I reviewed that content, some of the modules,
I can't tell you which ones
>> and I cannot tell you the answers
>> for either of those exams.
>> I also hold a Master's of Science in Cyber Security
>> and Information Assurance from
>> a Western Governor's University,
and then also an undergraduate degree in
Information Systems in Cyber Security Management.
A lot of my academic education
focused on the management aspects,
so like your CSO level type of stuff,
as well as the master's focused more
on the technical side of things.
For a couple of courses
>> where I got both the CEH and CHFI certs.
>> I've already helped
>> thousands of people around the world.
>> Actually tens of thousands of people around the world
passed both the CEH and CHFI exam.
A little bit about the course structure.
What to expect?
In most videos,
>> we're going to have like a pre-assessment.
>> All that's going to be It's like one or two questions.
Just testing your knowledge up front.
That way if you're familiar with the material,
you may not need to actually
>> watch that particular video.
>> We'll also try to incorporate
some post-assessment questions
>> to test your knowledge in each video.
>> Again, they may not be in every single video,
but we try to incorporate those throughout
the artistic type kind of gauge your knowledge.
Again, I want to stress that you need to download
the supplemental material
that's provided with this course.
That's going to be the notes
>> that I actually used to study
>> for my CHFI exam and full disclaimer,
>> I failed my CHFI for the first time.
That's what led me to be
>> more aggressive in my studying,
>> get better at it, and pass a second time
>> and then start helping other.
>> I've been there.
>> If you do take the CHFI
>> and you failed the first time,
>> not a life or death situation,
well hopefully not at least,
>> without a life or death situation.
>> You can bounce back like I did
>> and go ahead and pass it the second
>> time or even third or fourth time is
some people do around,
the goal is to just pass it.
>> That's the main goal.
>> Also, the course is going to be
primarily a video lectures.
We're going to have labs as well,
and those will also be videos,
but you'll be able to do those hands-on.
As I mentioned, labs,
>> we're going to have several labs throughout the course.
>> Now, one thing I want to stress is that
I'm going to list in the downloadable resources,
I'm going to list out all the possible labs
that I can find in the Cyber environment.
That's primarily if you have access to those labs,
but you're welcome to set up your own labs as well.
You can find different websites
that'll show you how to do that.
The other thing I just want to stress with
the Cyber relapse is that some of them
>> may take you like 20-30 minutes
>> or even like an hour to two to just harvest the data.
>> That's why I did not incorporate them like
in the actual film course just because it's not
pragmatic time-wise to sit there just
silently as we harvest data for 20 minutes.
But it made more sense to list those ones out that way.
If you want to go do those ones as well,
you're welcome to or to set up your own.
Again, the labs that we're going to cover in
this course visually and videos are
going to be labs that we can essentially
accomplish in that golden
like 10 minutes or less top of video.
That way you can quickly digest it,
quickly look at the lab,
and get information about it.
That way if you're at work on
lunch break or something like that,
we just want to make it more
correlated to you and your schedule
compared to like us making you sit there
for an hour and a half on a lab,
trying to take a look at it.
Again, keep in mind you want to make sure you download
all the resources that I'm providing in this course,
it's going to help you immensely as well
>> as I'm going to have a document listed
>> with the different lab
so you can just quickly know which ones you should do
>> to retain the knowledge in the course.
>> In this video, we just talked about my background.
We talked about what's going to occur in the course
as well as a course structure
>> kind of how it's laid out.
>> The next module is Module 1,
where we can talk about computer forensics today.
Again, we're going to be talking about
what is digital forensics.
We're actually going to be talking about different laws
>> that are applicable
>> at the 4th Amendment, FISMA, and HIPAA.