GIAC Certified Forensic Analyst

Memory holds what disk never sees. You learn when and how to collect volatile data, preserve its integrity, and set up an analysis workflow before you read a single process list.

• What memory contains that disk does not
• Order of volatility in practice
• Acquiring memory from live systems
• Preserving integrity and documenting the capture
• Hibernation files, page files and crash dumps
• Setting up Volatility and a repeatable workflow

You build A memory acquisition procedure and a first analysis of a captured image.

You find the abnormal by knowing the normal. You study how Windows processes, threads, handles, services and network connections appear in memory, and learn the parentage and behavior of standard system processes.

• Process structures and parent-child relationships
• Threads, handles and loaded modules
• Command lines and environment in memory
• Network connections and sockets in memory
• Services and the normal system process tree
• Reading a clean image end to end

You build A baseline reference of normal processes and connections taken from a clean memory image.

Attackers hide inside legitimate processes. You identify suspicious processes, injected code, unexpected drivers and rootkit behavior in memory, and confirm each finding with more than one view of the same data.

• Process masquerading and unusual parentage
• Code injection and hollowing indicators
• Suspicious drivers and kernel modifications
• Rootkit hiding techniques and how to cross-check them
• Extracting malicious code from memory
• Reporting memory findings with evidence

You build A memory analysis report on an infected image, naming each malicious element and the evidence for it.

File system knowledge is what lets you trust, or doubt, a timestamp. You study NTFS at the data storage, metadata and filename layers, and recover and analyze evidence at each.

• NTFS layout and the master file table
• The data storage layer: clusters and runs
• The metadata layer: attributes and records
• The filename layer and directory structures
• Resident data and alternate data streams
• Recovering deleted files from NTFS structures

You build A recovery of deleted files from an NTFS image, with a record of each structure used.

A timeline is the spine of most investigations. You collect timeline data from a Windows system, process it into a form that can be searched, and manage the volume without losing what matters.

• What a timeline can and cannot show
• Collecting file system and artifact timestamps
• Super timelines with log2timeline and Plaso
• Filtering and pivoting on time and keyword
• Time zone and clock normalization
• Documenting how the timeline was built

You build A super timeline from a sample image, filtered to the window of an incident.

Timestamps are evidence, but they move for many reasons. You learn how system and user activity change file system timestamps, interpret patterns of change, and recognize tampering such as timestamp manipulation.

• Standard information and filename timestamps compared
• How copy, move, create and delete change times
• Reading patterns in a timeline
• Detecting timestamp manipulation
• Correlating timeline events with logs and memory
• Presenting a timeline to others

You build A timeline analysis report that explains the sequence of an intrusion and flags manipulated timestamps.

Windows keeps copies and records that survive deletion. You collect and analyze artifacts showing that applications ran, and mine backup and restore data such as volume shadow copies for earlier states of the system.

• Evidence of application execution across artifacts
• Registry hives and their forensic use
• Volume shadow copies and restore points
• Backup data as a historical record
• Event logs and scheduled task evidence
• Cross-checking artifacts for consistency

You build An artifact analysis of execution and prior system states for one workstation.

An intrusion shows up as a departure from habit. You use memory and disk artifacts to document what normal system and user activity looks like on a host, and set the baseline that abnormal behavior is judged against.

• Normal user behavior in disk artifacts
• Normal system behavior and scheduled activity
• Comparing a suspect host with a clean reference
• Software and update baselines
• Documenting a baseline for an environment
• Using baselines to narrow the search

You build A baseline document for one system role, with the artifacts that define normal.

Finding the malicious is a matter of evidence, not intuition. You document indicators of compromise, find malware and attacker tools, tie activity to events and accounts, and recognize the techniques attackers use to hide it.

• Identifying indicators of compromise
• Finding malware and attacker tools on disk
• Tying activity to specific accounts and events
• Evidence cleaning and log tampering
• Hidden and encrypted data and tooling
• Writing indicators for other teams to use

You build A list of indicators of compromise with supporting evidence, from a compromised host.

Work a full intrusion case. You scope the response, analyze memory and disk, build the timeline, distinguish normal from hostile activity and write the findings an incident commander can act on.

• Scoping the case
• Memory and disk analysis of a key host
• Building and reading the timeline
• Identifying attacker activity and tools
• Reporting findings and indicators

You build A complete intrusion investigation report with memory, disk and timeline evidence.