CSX FORENSIC ANALYSIS COURSE

Introduction and Overview (Lesson)
In this lesson, students will:
- Receive an overview of forensics;

Chain of Custody (Lesson)
In this lesson, students will:
- Learn about evidence;
- Learn about Chain of Custody;

Media and Memory Types (Lesson)
In this lesson, students will:
- Learn about media types;
- Learn about memory types;

Forensics Enviornment (Lesson)
In this lesson, students will:
- Learn about Kali Linux;
-Learn about hardware and software needed to conduct forensic examinations;

Kali Forensics Environment (Lab/Instructional)
In this lab, students will:
-Receive an introduction to Kali Linux;
- Become familiar with basic Linux utilities;
- Use Command Line Interface (CLI);
-Learn how to help yourself with these utilities;
- Explore the Kali Graphical User Interface (GUI);

PostgreSQL Configuration (Lab/Instructional)
In this lab, students will:
- Prepare PostgreSQL database to receive forensic case data;
- Become familiar with basic Linux utilities;
- Configure your forensic environment;
- Configure a database;

Foreman Configuration (Lab/Instructional);
In this lab, students will:
- Receive an Introduction to Foreman, a Forensic Case Management system;
- Become familiar with basic Linux utilities;
- Configure your forensic environment;
- Install Foreman, a Forensics Case Management tool;

Final Foreman Setup (Lab/Instructional)
In this lab, students will:
- Finalize Foreman environment for forensic documentation;
- Customize the configuration of Foreman;
- Become familiar with basic Linux utilities;
- Create a script to automate running Foreman;

Imaging (Lesson)
In this lesson, students will:
- Learn about forensic images;
- Learn about imaging and imaging tools;
- Learn about managing damaged devices;

A New Case (Lab/Instructional)
In this lab, students will:
- Process digital evidence;
- Continue Chain of Custody;
- Intake evidence;
- Verify evidence integrity;
- Initiate a new case;
- Assign personnel to the new case;

Data Management (Lesson)
In this lesson, students will:
- Learn about compression;
- Learn about confidentiality;
- Learn about device wiping;
- Learn about integrity;

My First Case (Lab/Instructional)
In this lab, students will:
- Accept the new cas;
- Continue the chain of custody;
- Document the forensic process;
- Copy forensic images;
- Verify forensic copies;
- Uncompress forensic evidence;

A Picture (Lab/Instructional);
In this lab, students will:
- Analyze Digital Evidence;
- Extract Metadata from Various Files;
- Use a Script to Automate the Discovery Process;
- Learn an Anti-Forensics Technique;

Drives and Files (Lesson); In this lesson, students will:
- Learn about device types;
- Learn about partitions;
- Learn about file systems and file types;
- Learn about slack space, partitions and the partition table;

Data DNA (Lab/Instructional)
In this lab, students will:
- Maintain the Chain of Custody;
- Analyze Partition Information from Evidence Image;
- Extract Specific Partitions from Evidence Image for Further Analysis;
- Extract Slack Space from Evidence Image for Further Analysis;
- Extract Unallocated Space from Evidence Image for Further Analysis;

The Missing Piece (Lab/Instructional)
In this lab, students will:
- Maintain the Chain of Custody;
- Document process and results;
- Examine Slack Space;
- Manually Extract Data;
- Automated Recovery of Files;
- Examine Unallocated Space;
- Examine Allocated Space;
- Introduction to Autopsy;

Forensics Challenge (Lab/Challenge)
In this lab, students will use their knowledge from the previous CFAC labs to complete 5 challenge tasks.

The CSX Forensics Analysis Certificate Exam assesses a candidate’s ability to perform basic forensic analysis on a USB drive and recover files related to the given scenario. This one-hour exam contains no multiple-choice questions or simulations and intentionally restricts access to the internet. Where applicable, man pages and help files are available. To train for this exam, please see the CSX Forensics Analysis Course.

Candidates must complete tasks of varying durations with minimal instruction and are expected to:
- Carve files from a USB drive;
- Investigate recovered files for incriminating evidence, according to the scenario;
- Create a forensics report;
- Properly document evidence, procedures, and tools used;

Students must be comfortable leveraging the following tools:
- Foremost;
- Basic Linux Terminal Commands;