Part 6 - Capturing the data | Cybrary

NEED TO TRAIN YOUR TEAM? LEARN MORE

Did you know Cybrary's video training is FREE? Join more than 2,500,000 IT and cyber security professionals, students, career changers, and more, growing their careers on Cybrary.

Time

8 minutes

Difficulty

Intermediate

Video Activity

This lesson covers how to capture the data in order to preserve evidence. Investigators need to be able to capture on screen data such as open files, task bar, open windows, system tray as well ...

NEED TO TRAIN YOUR TEAM? LEARN MORE

Did you know Cybrary's video training is FREE? Join more than 2,500,000 IT and cyber security professionals, students, career changers, and more, growing their careers on Cybrary.

This lesson covers how to capture the data in order to preserve evidence. Investigators need to be able to capture on screen data such as open files, task bar, open windows, system tray as well as gadgets and sidebars, system time and date. Collecting information following an incident needs to be thought of as a triage: know what information is being sought, what are the requirements and what will answer them and what techniques are needed to obtain the information? After the triage process, the data is imaged.

Part 1 - An Overall View of the Course

Part 2 - The Humans Behind Cyber Security Incidents

Part 3 - The Sony Hack Case Study

Part 1 - An Overview of Incident Response Policy

Part 2 - The Elements of an Incident Response Policy

Part 3 - The Role of Communication with Law Enforcement when it comes to security

Part 4 - The Different Types of Incident Response Teams

Part 5 - Outsourcing Considerations

Part 6 - The Role of the Incident Response Manager

Part 7 - What does an Incident Response team do?

Part 1 - An Introduction to Incident Handling

Part 2 - CIRC Team Composition

Part 3 - Incident Response Policies

Part 4 - The REACT Principle

Part 5 - Maintaining the Integrity of the Scene following an incident

Part 6 - The Content of Notice

Part 7 - The Respond Part of Incident Response

Part 1 - An Introduction to legal considerations of incident response

Part 2 - Expectation of Privacy

Part 3 - Personally Identifiable Information (PII)

Part 4 - Giving notice to individuals

Part 5 -Benefits of Information Sharing

Part 1 - Forensics in Support of an Incident Response

Part 2 - The Phases of Investigation

Part 3 - The Preservation Phase of Investigation

Part 4 - Keys of Preservation

Part 5 - Volatile Data Considerations

Part 6 - Capturing the data

Part 7 - Imaging concepts

Part 8 - Volatile Memory Capture

Part 9 - Forensics in Support of Incident Response

Part 10 - Formatting a disk for Incident Response

Part 11 - Using the FTK Imaging Software

Part 12 - The Forensic Acquisition of Data from a PC

Part 13 - Navigating the H Drive

Part 14 - Obtaining the Windows Bitlocker Encryption Keys

Part 15 - Obtaining the Windows Bitlocker Encryption Keys (continued)

Part 16 - The Autopsy Program

Part 1 - What is Insider Threat?

Part 2 - American Superconductor Case Study

Part 3 - Indicators to identify an insider threat

Part 4 - Using Automated processes to look for indicators of in insider threats

Part 5 - Policy Enforcement

Part 6 - Policies and procedures

Part 7 - Policies and procedures (continued)

Part 8 - Policies and procedures (continued)

Part 1 - Malware incidents

Part 2 - Setting up a Virtual Machine

Part 3 - Dynamic Analysis

Part 1- Incident Recovery

Part 2 - Resiliency: The Answer to the Cyber Security Paradox

Introduction to SIEM

Responding to Cyber Security Incidents

Mastering Cyber Attribution

Incident Response & Advanced Forensics