This is the course agenda for Forensics 585.
Since you're taking this class on-demand,
you could skip around on sections,
but we do not recommend that.
Lee and I laid out this course in a way
that we paved foundations for you to have success.
So if you skip immediately to Section 5,
you would be doing things manually that you have not
done leveraging the tools yet, and that kind of
defeats the purpose of the course.
In this section, we are going to lay the foundations.
We are going to teach you key concepts in Physical Analyzer
and AXIOM.
We are not teaching you to become masters of these tools.
If you want to master a specific tool,
you should take vendor training to do that.
That is not what this course is designed to do.
This course is designed to teach you
how far your tools can take you before you
have to take matters into your own hands
and do things manually.
This course is also huge on validation and teaching you
methods to validate what your tool is showing you,
because the tool's job is to take data from a smartphone
and present it to you.
You have to decide how that data got there.
Is it user-created?
Is it system-created?
That is 100% up to you.
I read something once-- and I have
been putting this in a lot of my presentations--
that the tool is only as strong as the person
sitting behind that keyboard of that examination platform.
That is you.
So make sure you are not putting 100% faith in any artifact
without verifying it before you put something
in your report that could put something--
or someone in prison or exonerate someone
that could have committed a heinous crime.
So this is your job, and I hope we teach you
that in this course.
At the end of this section, that is
when we start doing some SQLite forensics,
and we actually touch Android at the end of the section.
You'll see Section 2 is 100% Android forensics.
So Section 1 and 2 kind of go hand in hand.
In Section 3, we start with iOS.
Section 3 then leads into Section 4.
So the first half of that section
will complete iOS forensics.
And then we dive into malware on iOS and Android devices.
And we finish with evidence destruction on Section 4.
This section is so important.
Most people don't think about what evidence destruction
actually means.
Is someone simply deleting a file,
or are they wiping their entire Android and iPhone
and trying to hide data from you?
What does that look like and how can you uncover it?
Sometimes, starting with evidence destruction
will save you so much time.
If you're hunting for a file you can't find,
why is it not there?
Is it because someone purposely tampered with that evidence?
Section 5 is one of my favorites.
We've taken away all of your forensic extractions.
Everything that I teach you from Section 1 through Section 4,
you're going to be tested to do manually.
It is a lot of fun, and a lot of people
enjoy Section 5 and those labs.
Ultimately, all of these sections
will lead you to the forensic capstone.
Now, where Lee and I are different--
we challenge you to play this capstone.
We want you to work this case and challenge us
for a challenge coin.
When we get to Section 6, I will prep you
for methods you can take to earn that challenge coin.
Now, something you have to be cautious on.
In your Dropbox, you are going to see a directory called
Day 6-- do not peek.
If you peek, it will disqualify you
from earning the coin in this course.
We will know if you've done that, so please do not cheat.
Be true to yourself.
And challenge yourself to actually do this challenge.
I realize some people say, well, I've
taken a SANS training in person or hybrid,
and I got to play as a team.
Correct.
What you could do is, you could always reach out
to your online SME and see if anyone else is taking
the class at the same time, or reach out to me
and I could put something in the Google group saying,
does anyone want to play this challenge with student X?
You could do that.
But you also have more time.
So take your time, interact with Lee and I,
and try to earn that challenge coin.
It's awesome when we get to see you virtually present to us
your findings that you found in this course.