Linux Forensics w/ Hal Pomeranz

Linux Forensics w/ Hal Pomeranz (4 Sessions – 4 Hour Classes)

Instructor: Hal Pomeranz

Includes: Live presentation, PDF with slides and author notes, VMware virtual machine containing lab exercises and sample forensic images, Six-month complimentary access to our Cyber Range, Course certificate.


Linux is everywhere– running in the cloud, on cell phones, and in embedded devices that make up the “Internet of Things”. Often neglected by their owners, vulnerable Linux systems are low-hanging fruit for attackers wishing to create powerful botnets or mine cryptocurrencies. Ransomware type attacks may target Linux-based database systems and other important infrastructure.

As attacks against Linux become more and more common, there is an increasing demand for skilled Linux investigators. But even experienced forensics professionals may lack sufficient background to properly conduct Linux investigations. Linux is its own particular religion and requires dedicated study and practice to become comfortable.

This two-day, hands-on course is a quick start into the world of Linux forensics. Learn how to use memory forensics to rapidly triage systems and spot attacker malware and rootkits. Learn where the most critical on-disk artifacts live and how they can help further an investigation. Rapidly process Linux logs and build a clearer picture of what happened on the system.


KEY TAKEAWAYS

  • Acquiring and analyzing Linux memory
  • Accessing complex Linux disk geometries
  • Rapid triage for key Linux artifacts
  • Linux log analysis

WHO SHOULD TAKE THIS COURSE

  • Experienced forensic professionals wanting to expand their Linux knowledge
  • SOC analysts needing a stronger grounding in Linux
  • Administrators/developers defending Linux infrastructures

AUDIENCE SKILL LEVEL

This course is an introduction to Linux forensics, but not an introduction to forensics. The course assumes at least some knowledge of digital forensic methods, such as evidence acquisition. This course is heavily command-line driven, so basic familiarity with the Linux command-line is helpful.


STUDENT REQUIREMENTS

  • High-speed Internet access
  • A BitTorrent client for downloading course materials (e.g., Transmission https://transmissionbt.com/download/)
  • A computer with at least 150GB of free space and capable of running a 64-bit VMware virtual machine using 4GB of RAM

WHAT A STUDENT SHOULD BRING

A properly configured computer and natural curiosity!


WHAT STUDENTS WILL BE PROVIDED WITH

Students will receive course slides and author notes, lab exercises and virtual machine, and sample forensic images.


TRAINER & AUTHOR

Hal Pomeranz is an independent digital forensic investigator who has consulted on cases ranging from intellectual property theft, to employee sabotage, to organized cybercrime and malicious software infrastructures. He has spent more than thirty years providing pragmatic Information Technology and Security solutions for some of the world’s largest commercial, government, and academic institutions.


COURSE SCHEDULE


Dates/Times
:

Tue, October 12, 2021 11:00 AM – 4:00 PM EDT

Wed, October 13, 2021 12:00 PM – 4:00 PM EDT

Thu, October 14, 2021 12:00 PM – 4:00 PM EDT

Fri, October 15, 2021 12:00 PM – 4:00 PM EDT

Event Type: Virtual

Register to attend this course virtually in October here


Join the Wild West Hackin’ Fest Discord server to stay updated on future training and webcasts: Join Our Server!