NET 373 - Forensic Prac Cybersecurity

1. Interpret computer codes and numbering systems
   1. Describe ASCII codes
   2. Explain Binary numbering systems
   3. Explain Hexadecimal numbering systems
2. Evaluate purpose of a computer operating system (OS) and its components
   1. Define kernel
   2. Differentiate between single-user and multi-user systems
   3. Explain file management
   4. Explain memory management including virtual memory/swap space
   5. Explain OS security
3. Compare and contrast the main user features and typical user data of various, PC-class, operating systems including but not limited to
   1. DOS
   2. Windows NTx (NT, 2K, XP, Vista, Server 20xx, Win7, Win8, Win10)
   3. UNIZ/POSIX (Linux/OS X)
4. Demonstrate effective use of a Hex Editor application.
   1. Explain the term offset.
   2. Practice inserting, altering, deleting, and carving data using the software tool.
   3. Describe HPFS
   4. Describe NFS
   5. Describe HFS Plus
5. Assess significance and key components of boot records.
   1. Contrast Master Boot Record (MBR) and GUID Partition Table (GPT) organizational schemes.
   2. Decode appropriate data structures to identify volume parameters on a storage device.
   3. Identify file attributes and permissions
   4. Describe metadata
   5. Describe beneficial OS-specific artifacts and logs
6. Understand and identify different file systems, including respective data saving, recall and deletion methods.
   1. Describe FAT/FAT16/FAT32.
   2. Describe NTFS
   3. Describe exFAT.
   4. Describe Extended File System (ext2/ext3/ext4).
   5. Describe HFS Plus.
7. Analyze primary user data and OS artifacts.
   1. Describe file naming conventions.
   2. Describe dating methods (creation/modification/access).
   3. Identify file attributes and permissions.
   4. Recognize common file extensions including, but not limited to: .txt, .pdf, .doc, .docs, .xls, .jpg, .gif, .bmp, .tmp, .htm, .xml, .log, .zip.
   5. Explain the correlation of “magic numbers”/file signatures and specific application data.
   6. Describe metadata.
   7. Describe beneficial OS-specific artifacts and logs.
8. Demonstrate appropriate evidence acquisition techniques
   1. Document system physical topology
   2. Document logical system characteristics including BIOS properties, boot configurations and date/time settings
9. Assess common secondary data storage
   1. Identify physical interfaces
   2. Differentiate between magnetic and solid state storage
   3. Describe standard hard drive geometry, addressing, and configuration
   4. Describe purpose/functionality of RAID
   5. Define slack
   6. Describe optical storage solutions
10. Demonstrate appropriate procedures for forensic duplication
    1. Describe the purpose of and demonstrate proper wiping techniques
    2. Show proper write-blocking using accepted methods
    3. Describe the function of hash values in authentication of data acquisition
    4. Describe the function of compression in data acquisition
11. Analyze data
    1. Use manual methods to retrieve data
    2. Use popular tools to automate analysis including EnCase and FTK
    3. Apply data hash value comparisons to improve efficiency
12. Examine typical user data and system files using automated tools
    1. Perform searches using various keywords and contextual indicators
    2. Examine data contained in compressed data files/containers