SANS – FOR498: Battlefield Forensics & Data Acquisition

FOR498, a digital forensic acquisition training course, provides the necessary skills to identify the many and varied data storage mediums in use today, and how to collect and preserve this data in a forensically sound manner despite how and where it may be stored. It covers digital acquisition from computers, portable devices, networks, and the cloud. It then teaches the student Battlefield Forensics, or the art and science of identifying and starting to extract actionable intelligence from a hard drive in 90 minutes or less.

FOR498: Battlefield Forensics & Acquisition Course will help you to

Acquire data effectively from

• PCs, Microsoft Surface, and Tablet PCs
• Apple Devices, and Mac, and Macbooks
• RAM and Memory
• Smartphones and portable mobile devices
• Cloud storage and services
• Network storage repositories

Produce actionable intelligence in 90 minutes or less

You Will Be Able To

• Learn and master the tools, techniques, and procedures necessary to effectively locate, identify, and collect data no matter where it is stored
• Handle and process a scene properly to maintain evidentiary integrity
• Perform data acquisition from at-rest storage, including both spinning media and solid-state storage
• Identify the numerous places that data for an investigation might exist
• Perform Battlefield Forensics by going from evidence seizure to actionable intelligence in 90 minutes or less
• Assist in preparing the documentation necessary to communicate with online entities such as Google, Facebook, Microsoft, etc.
• Understand the concepts and usage of large-volume storage technologies, including JBOD, RAID storage, NAS devices, and other large-scale, network addressable storage
• Identify and collect user data within large corporate environments where it is accessed using SMB
• Gather volatile data such as a computer system’s RAM
• Recover and properly preserve digital evidence on cellular and other portable devices
• Address the proper collection and preservation of data on devices such as Microsoft Surface/Surface Pro, where hard-drive removal is not an option
• Address the proper collection and preservation of data on Apple devices such as MacBook, MacBook Air, and MacBook Pro, where hard-drive removal is not an option
• Properly collect and effectively target email from Exchange servers, avoiding the old-school method of full acquisition and subsequent onerous data culling
• Properly collect data from SharePoint repositories
• Access and acquire online mail stores such as Gmail, Hotmail, and Yahoo Mail accounts