Visão Geral

Este curso apresenta os fundamentos de Digital Forensics, incluindo preservação de evidências, aquisição, análise de sistemas, investigação de arquivos, registros, logs e construção de timelines.

Objetivo

Após realizar este curso, você será capaz de:

• Compreender processos de Digital Forensics
• Preservar e analisar evidências
• Construir timelines
• Apoiar investigações de incidentes

Publico Alvo

• Profissionais de DFIR
• Incident Responders
• Cybersecurity Professionals
• SOC e Blue Team

Pre-Requisitos

• Conhecimentos de Windows
• Conhecimentos básicos de Linux
• Noções de sistemas de arquivos
• Conhecimentos básicos de redes
• Noções de incident response

Conteúdo Programatico

Module 1: Digital Forensics Fundamentals

1. Digital Forensics concepts
2. Forensic investigation lifecycle
3. Evidence types
4. Evidence preservation
5. Chain of custody
6. Forensic integrity
7. Investigation planning
8. Forensic documentation
9. Legal and procedural considerations
10. Forensic investigation methodology

Module 2: Evidence Acquisition

1. Evidence acquisition
2. Disk imaging
3. Memory acquisition
4. File acquisition
5. Network evidence
6. Log acquisition
7. Evidence hashing
8. Evidence validation
9. Acquisition documentation
10. Evidence preservation

Module 3: File System Forensics

1. File systems
2. File metadata
3. Deleted files
4. File timestamps
5. File carving
6. Hidden files
7. Alternate data
8. File system artifacts
9. File integrity
10. File system investigation

Module 4: Windows Forensics

1. Windows artifacts
2. Registry
3. Event Logs
4. Prefetch
5. Windows services
6. Scheduled Tasks
7. User activity
8. Browser artifacts
9. Execution artifacts
10. Windows forensic investigation

Module 5: Timeline Analysis

1. Timeline concepts
2. Timestamp analysis
3. Event correlation
4. File system timelines
5. Authentication timelines
6. Process timelines
7. Network timelines
8. Activity reconstruction
9. Timeline validation
10. Investigation reporting

Module 6: User and Application Forensics

1. User activity
2. Browser artifacts
3. Application artifacts
4. Authentication artifacts
5. Download artifacts
6. Document activity
7. Application execution
8. User profile analysis
9. Artifact correlation
10. User activity reconstruction

Module 7: Forensic Investigation

1. Evidence analysis
2. IOC identification
3. Malware indicators
4. Persistence indicators
5. Credential compromise
6. Lateral Movement
7. Data access
8. Attack reconstruction
9. Findings validation
10. Forensic reporting

Module 8: Practical Digital Forensics

1. Evidence acquisition
2. Artifact analysis
3. Registry investigation
4. Event Log investigation
5. File system analysis
6. Timeline construction
7. IOC identification
8. Attack reconstruction
9. Evidence documentation
10. Digital forensics case study