Learn Linux Forensics
Step into the world of Linux Forensics with this hands-on course. Discover how Linux file systems work, uncover key forensic artifacts, and get comfortable using tools that are essential in real investigations. This course is tailored for IT specialists, cybercrime investigators, and anyone passionate about security who wants to enhance their forensic skills and career opportunities.
Why Should You Learn Linux Forensics?
Linux is widely used in penetration testing and cybersecurity, but have you ever stopped to ask: Are these tools always used for the right reasons? The answer is simple: No.
Now, picture this—you arrive at a crime scene, and the suspect’s computer is running Linux. If you’re not prepared, you’ll quickly find yourself stuck, questioning your abilities. Where do you start?
Do you know how to gather evidence from a Linux system?
Can you recognize and interpret forensic artifacts?
How do you trace user actions or uncover hidden data?
This course is designed to give you the confidence and skills to handle such challenges, so you’re never caught off guard when faced with a Linux-based system during an investigation.
Learners who complete the course and pass the exam will earn the C5W Certified Linux Forensic Analyst (CCLFA).
1. On-Demand, Self-Paced Learning
-
Format: Self-paced online course with pre-recorded materials.
-
Content: Includes over 20 hands-on labs and 8 hours of recorded lectures.
-
Access: 40 hours of virtual lab access included.
-
Ideal For: Individuals seeking flexibility in learning schedules.
2. Certification Exam
-
Included: One attempt at the Certified Linux Forensic Analyst (CCLFA) certification exam.
-
Objective: Validates the skills and knowledge acquired during the course.
-
Introduction to Linux
- Introduction to Linux Forensics
- Understanding the Linux FHS
- Understanding and Investigating Core Linux Components
Essential Tools and Techniques
- Linux Boot Process
- Linux System and Service Managers
- Acquisition
- Searching and Navigation Linux Systems
System Analysis
- Searching and Navigation Linux Systems
- Network Services & Network Connections
- Searching Devices & Volumes
- Variables, Shells, Profiles, Cronjobs, etc
- Users & Groups
- Processes & Applications
File Systems and Log Analysis
- Intro. to Linux EXT4 File System
- Analysis Using The Sleuth Kit (TSK)
- Analysis Using DebugFS
- Analyzing Linux Logs
- The ProcFS & TmpFS File Systems
GUI & USB Forensics
- Investigating Linux GUI
- Investingating Linux Desktop Environments
- Linux USB Forensics
Writing Forensics Reports
- What Is The Forensics Report?
- The Importance of Forensics Report
- Forensics Report Sections
- Reporting Standards And Guidelines
- Conclusions And Recommendation
Hands-on Labs
- Case #1 - Investigating a Compromised Web Server
- Case #2 - Investigating Suspicious Processes
- Case #3 - Investigating a Kali Linux Systems
- Case #4 - Investigating a Compromised Cluster
- Case #5 - Traffic Acquisition and Analysis
- Case #6 - Investigating Linux Desktop Environments
- Case #7 - Investigating a Compromised Web Server #2
- Case #8 - Timeline Analysis
- Searching through the FHS
- Working with volumes and mounting forensic case images
- Search in log files
- Using TSK to list forensic image info and work with EXT4 file systems
- Use debugfs and EXT4 journals to recover deleted files
- Tracking running processes
- Using the ProcFS to the benefit of your IR
- Extracting processes from memory