digital forensics

Computer forensics are of interest not only for law enforcement. There is a number of reasons for conducting forensic analyses at enterprise level. Nevertheless, its realisation may be complicated and may pose various problems for administrators. On the one hand, adequate proprietary software is very expensive. On the other hand, in many cases insider knowledge not documented publicly is required.

This training course relies on Linux's strong points. There is hardly an operating system more capable of analysing the multitude of existing file systems used by varied operating systems, of examining specific files' timeline or restoring deleted files. As virtualisation is becoming more important in this context, Virtualbox and KVM are major helpful tools.

In this training course, we will configure a Linux-based examination system and learn the forensic basics of file system analysis. The approaches featured in this training course are applicable to all current dektop operating systems and will be put into practice using the example of Windows.

Based on this training course, we are also offering an advanced training course Linux/BSD server analysis and forensics.