Operating System Forensics

Criminals rely on the intricacies of operating systems like Windows, macOS, and Linux to conceal their activities and hide data. However, a skilled digital forensics expert knows the places to look and the tools to use to access evidence of their crimes. This course covers all the major concepts and tools of the growing field of operating system forensics. Instructor Jungwoo Ryoo (J.R.) reviews the fundamentals: the goals, history, and roles of operating system forensics and the future of the industry. He then shows how to acquire evidence from file systems, slack space, alternate data streams, and main memory. Jungwoo uses a combination of free and commercial software, so you can practice techniques like file recovery and live acquisition with the tools that are within your budget.

Learning objectives
Understanding operating system forensics.
Understanding job prospects in operating system forensics.
Using GParted.
Using Hex editors.
Preparing for certifications.
Acquiring data from various sources including file systems, main memory, and operating system logs.