|
所在平台: Udemy |
课程主页: https://www.udemy.com/course/surviving-digital-forensics-imaging-a-mac-fusion-drive/
课程评论：没有评论
课程简介：生存数字取证：成像Mac Fusion驱动器 欢迎加入生存数字取证系列课程。本系列的目标是帮助您成为更出色的计算机取证检查员，通过教授核心计算机取证技能，使您在大约一小时内获得相关知识。在本课程中，您将学习如何仅使用Mac和免费的软件来对Mac进行成像。这不仅为您提供了额外的成像选项，还为成像Mac Fusion驱动器提供了解决方案。课程采用实践操作的方式进行学习。 课程结构如下： 1. 欢迎与SDF系列介绍 2. 本课程的主要内容 3. 如何最大化利用此课程 4. 问题与解决方案 5. 准备取证系统 6. 成像步骤下载 7. 关闭磁盘仲裁 8. 在终端中识别证据 9. 使用DCFLDD进行成像 10. 锁定您的DMG文件 11. DCFLDD的详细介绍 12. 获取DCFLDD版本 13. 使用不同的哈希算法 14. 拆分您的图像 15. 更改图像段的文件扩展名 16. 成像分区 17. 成像Mac Fusion驱动器 18. Mac成像测验 19. 感谢与最终想法 本课程要求您使用运行OS 10.9及以上版本的Mac。如果您使用的是10.7或10.8，可能也能顺利参与，但建议使用更新的平台。我们使用的取证工具均为免费提供，因此除了操作系统外，您只需有成为更优秀的计算机取证检查员的渴望。
Welcome to the Surviving Digital Forensics series. This series is focused on helping you become a better computer forensic examiner by teaching core computer forensic skills - all in about one hour. In this class you will learn how to image a Mac using only a Mac and freely available software. This will give you not only an additional imaging option but also provide you a solution for imaging Mac Fusion drives. As with previous SDF classes you will learn by doing. The class begins with a brief overview of the issue at hand. Then we set up our forensic systems and off we go. Learning is hands on and we will use low cost and no cost computer forensic tools to do so. Expert and novice computer forensic examiners alike will gain from this class. Since we are doing it the SDF way we are going to teach you real computer forensic skills that you can apply using our method or customize to meet your needs. We cover basic imaging as well as some additional options you may need such as, splitting an image, using different hash algorithms, imaging partitions and more. Class Outline 1. Introduction and Welcome to the SDF series 2. What this class is all about 3. How to get the most of this class 4. The problem and the solution 5. Getting your forensic system setup 6. Imaging steps download 7. Turning off Disk Arbitration 8. Identifying your evidence in Terminal 9. Imaging with DCFLDD 10. Lock your DMG file 11. DCFLDD breakdown 12. Getting the DCFLDD version 13. Using different hash algorithms 14. Splitting your image 15. Changing the image file extensions of your image segments 16. Imaging partitions 17. Imaging Mac Fusion drives 18. Mac imaging quiz 18. Thank you & final thoughts A Mac running OS 10.9+ is required for this course. If you are running 10.7 or 10.8 you likely will be okay, but a more up-to-date platform is recommended. The forensic tools we use are all freely available, so beyond your operating system all you need is the desire to become a better computer forensic examiner.
