Hey everyone I'm Graig Arnold and I'll be a voice for Markoe MONEY.
Welcome to digital forensics with Kelly Linux a video course by pact publishing.
Let's give a little background about Marco al-Mahdi.
He's an I.T. security professional with experience of penetration testing also digital forensics using
the Kalli Linux distribution mainly working in the financial and insurance service industry.
He also authored the book Kelley Linux wireless penetration testing essentials for Pacht this is an
overview of the course which is for the most part practice oriented and focuses on leveraging Kelly
Linux for digital forensics.
The first goal of the Course is to recall the basic theory of digital forensics then to fully understand
what we'll do in practice.
Next goal is learning to practical use the tools provided by Kelly Linux to perform the digital forensics
process.
We'll see how to acquire images from different types of media and devices extract and analyze artifacts
from them recover deleted data acquired analyze a live memory and network traffic packets finally will
cover how to report and present the findings with the tools included in Cali Linux.
Note that the Course does not cover all the forensic tools included in Cali lyrics but rather the most
relevant for our purposes.
The first section introduces the fundamentals of digital forensics in order to understand the practice
and show how to download Kalli Linux and install it in a VM.
If you want you could skip this part.
If you're already familiar with the distribution Section 2 is about acquiring images of media that could
be either hard drives USP drives memory cards and mobile devices.
We start by explaining the fundamentals of the forensic acquisition process then introduce the DC f
l d d and DC 3 d d forensic acquisition tools.
This also covers image acquisition with the DC 3D tool.
First we explain the tool and its various options that we see two practical examples of its usage.
With the hard drive and partitions of an Android device if you don't feel comfortable with Scioli tools
don't worry.
This section also covers Aji why imaging utility guy major which allows you to image medius with a few
mouse clicks.
This section we see the same two practical examples of the previous section using this tool.
So far we've seen how to image medius and to be analyzed.
Third Section we covered the extraction and analysis phase we introduced the sleuthed kit set of tools
to examine the file system and differed Seelye tools.
This will extract and analyze the most significant artifacts using as an example an image of a Windows
system registry keys browser email and I am artifacts and file meta data.
Then we show how to use log to timeline slash Plass so to build a super timeline Section 4 we described
the file carving concepts and present 3 carving tools for recovering deleted data bypassing the file
system like for most scalpel and photo rec and we cover bulk extractor which is a tool that can extract
many useful data from a raw image.
Section 5 is a time of an all in one forensic suite autopsy for this version is not installed by default
on Kelly Widex but it's really worth installing it because it has many new features and an improved
graphical interface will see how to install and use it to automate the extraction and analysis activities
which were described in the previous sections.
Also how to analyze an android image with the android analyzer module.
Section 6.
We start with an overview of the memory forensics theory and we described the tools and the procedure
to acquire a live memory image.
Then it shows how to use volatility to extract and analyze artifacts from the memory image.
Section 7 is about network forensics where we explain how to capture network packets and analyze them
with wireshark.
Final section of the course covers the reporting phase using the tools provided by Kalli Linux.
That's about it for the overview of the course.
Now we could get started with the first section installation and setup.