I now want to take some time to show you
this electronic workbook.
And I'm going to switch to the virtual machine
here in a moment.
The electronic workbook could change
as you're taking this course.
And you may think, Heather's crazy.
I downloaded this.
What is she talking about?
Let's say you email me and say, Heather,
I found a typo in Lab 2.1a.
I can fix it on the fly.
So if you update your workbook, it will have that fixed typo.
However, something to keep in mind-- your PDF
does not change magically like that.
So your PDF stands as is.
Your e-workbook will be the latest and greatest version
of that course, which means if you're taking this course,
you may want to update your e-workbook on occasion,
just to have the latest and greatest so you can redo labs.
Please keep that in mind.
If you find any typos or anything
that you've done differently that you think
we should consider for the e-workbook,
you can always reach out to Lee and I. And if we can,
we will add it.
So I'm now going to switch to the VM
and show you this e-workbook.
On your desktop of your virtual machine, you'll see a star.
And that star says SANS FOR 585 Workbook.
That is where your workbook's stored.
If you also launch Firefox, it will appear.
We take a look at the workbook.
What you're going to see is, you have resources,
you have exercises, you have multiple different things
up on the left.
So here, we can see resources--
things like your poster, the DFR website,
how to actually run through these labs.
Most of us will go into the exercises for each section.
So you'll see, we're on Section 1.
And we have the different exercises listed here,
starting with Lab 0.
As you go through the workbook, it's going to tell you,
this is what to expect.
It's telling you how to update.
Now, this right here is extremely important.
Workbook-- Update.
This will let if you have the most recent version
of that workbook.
I recommend, if you stop on-demand and come back,
you always run this to make sure you
have the latest and greatest.
Because someone who's a little bit further than
you in the course may have found something
that they wanted us to fix.
In order to fix this, what you're going to do
is click on the bash shell.
And you are going to type exactly what
the lab tells you-- just the words workbook, dash, update.
That's it.
And you press Enter.
And it's saying it's the beginning the update process.
It's updating workbook files.
And complete.
If it says nothing to update, great.
If it goes through and updates, something has changed,
and now you have the latest and greatest.
If you have it open, I recommend doing a refresh just
to ensure that you have, honestly, anything that is new.
Now, I want to walk you through a few things here.
So let's look at Lab 1.1.
And this is going to be coming up.
How this is laid out.
The objectives are going to tell you why you are spending time
doing this lab.
What is the goal?
What are you going to walk away with knowing
when you finish it?
We treat every single lab as if your VM's not started.
So we tell you to log in to your workstation, type the word
"forensics".
We tell you where your data is stored.
And most importantly, we tell you
how to load it inside of every single tool.
If you only want to use certain tools,
you may see that we tell you how to load it into four tools.
Whatever I recommend during the prep for that lab
is what I recommend you do.
But you have many choices in most of these labs.
One of the biggest complaints that we
had with the printed books were that people would turn the page
and see the answer.
This is your opportunity to not see any answers.
Do not turn the page if you don't want to see it.
By turning the page, I mean clicking the down arrow.
So when you click on this, it's going to tell you answers.
And then what's interesting is, you can also
click on Step by Step.
Say you can't solve it or you're curious on how it was solved.
If you click on Step by Step, you can actually go through
and you can click on the magnifying glass
and see enlarged graphics on how we actually solved this lab.
So it's pretty unique in what you can get.
And you can Zoom in as much as you want or need to.
And then ultimately, at the end, there will be key takeaways.
Now, I do want to show you something.
When we get into later sections of this course,
we are going to be interacting with the command line.
Some people do not like the command line.
They struggle with it.
So something you will notice with some of these tools
is, you can actually copy some of the commands
and paste them right inside.
You could copy what you need and paste it into the command line
if that helps you.
Some of the labs have queries, for example.
If I go into--
let me find a query lab.
If we look, are going to find where you find boxes like this.
What you can do is, you can copy it.
And it says Copy to clipboard and Paste it
into the tool of choice.
So if you're just not having success typing something,
this is here to help you succeed.
I recommend struggling.
And you'll see, I will have typos
that I will keep in this recording for you.
I want you to see where I struggle.
I will purposely show you mistakes.
I will show you typos, what it looks like,
because it's only going to help you learn.
This is your overview of your e-workbook.
Remember, the objectives teach you
what you're going to do in that lab.
Then you have your questions and your answers,
with walkthrough as needed.
And then you have your key takeaways from each lab.
And you're going to see, there are 35 labs total
in this course.