This course is designed to help forensic examiners who lack an understanding of Linux artifacts as well as how to leverage Linux tools for conducting forensic exams. To meet this goal, the students will learn Linux operating system fundamentals and gain proficiency with command line and bash shell scripting to accomplish forensic tasks. This knowledge will be leveraged to learn strategies for analyzing Linux systems by examining scenario-based images of Linux systems.
Students will be provided with a laptop with Linux installed as the base operating system that is theirs to keep. A virtual machine running Windows will be installed to explore Microsoft’s Windows Subsystem for Linux (WSL), showing how it can be used to help with analysis, as well as its impact on Windows forensic analysis. A series of hands-on scenarios help to reinforce lectures and build Linux skills.
This course assumes the student has some experience doing Windows forensic investigations, but little or no experience using and/or analyzing Linux. The only prerequisite for the class is a willingness to type commands rather than click a mouse.
