Name: IT Forensics for System Administrators
Start: 2021-11-23T11:00:00+01:00
End: 2022-01-27T12:30:00+01:00
Location: No location set

Monday, November 22, 2021
Tuesday, November 23, 2021
11:00 AM IT Forensics for System Admins - Organisation - Klaus Möller (DFN-CERT)
IT Forensics for System Admins - Organisation
- Klaus Möller (DFN-CERT)
11:00 AM - 12:30 PM
Dealing with the organisational aspects of incident handling and forensics may sound like dry paperwork far away from the technical details of day-to-day sysadmins tasks. However, organisational preparation can help tremendously in the course of an investigation. For example answering simple practical questions like "who's in charge?" or "what are we looking for?", even "why are we doing this?". This module introduces the basic steps of incident handling and forensic investigations and introduces attendees to the principles of forensic investigations that should be adhered to for an investigation to succeed.
Wednesday, November 24, 2021
Thursday, November 25, 2021
Friday, November 26, 2021
Saturday, November 27, 2021
Sunday, November 28, 2021

Monday, November 29, 2021
Tuesday, November 30, 2021
11:00 AM IT Forensics for System Admins - From Suspicion to Detection I - Stefan Kelm (DFN-CERT)
IT Forensics for System Admins - From Suspicion to Detection I
- Stefan Kelm (DFN-CERT)
11:00 AM - 12:00 PM
So you or someone in your organisation notices "unusual system behaviour" or "suspicious network traffic" but you are not sure what to do about it? The first step in incident response usually is to ascertain whether or not the activity observed really is an incident. While there is no formal process or definition for doing so, there's a large number of locations for possible indicators to look for that may eventually make an incident. Participants will learn what the first steps to take after a compromise has been detected.
Wednesday, December 1, 2021
Thursday, December 2, 2021
11:00 AM IT Forensics for system Admins - From Suspicion to Detection II - Stefan Kelm Kelm (DFN-CERT)
IT Forensics for system Admins - From Suspicion to Detection II
- Stefan Kelm Kelm (DFN-CERT)
11:00 AM - 12:00 PM
Friday, December 3, 2021
Saturday, December 4, 2021
Sunday, December 5, 2021

Monday, December 6, 2021
Tuesday, December 7, 2021
Wednesday, December 8, 2021
Thursday, December 9, 2021
11:00 AM IT Forensics for System Admins - Memory Acquisition I - Stefan Kelm (DFN-CERT) Klaus Möller (DFN-CERT)
IT Forensics for System Admins - Memory Acquisition I
- Stefan Kelm (DFN-CERT)
- Klaus Möller (DFN-CERT)
11:00 AM - 12:00 PM
Whatever malware is doing on a computer, the code to carry out its activity has to be in the random access memory (RAM). And not only this, lots of other interesting stuff is present there too: IP-addresses of computers it has communicated with, data from attacks against other systems or even exfiltrated data. By getting information directly from the storage, compromised operating system components can be bypassed. No wonder that investigating transient memory has become a hot topic in IT forensics over the last decade. But before memory contents can be scrutinized, they will have to be acquired from the computer. This webinar covers the basic principles and techniques behind memory acquisition on Linux, Windows and MacOS operating systems.
Friday, December 10, 2021
Saturday, December 11, 2021
Sunday, December 12, 2021

Monday, December 13, 2021
Tuesday, December 14, 2021
11:00 AM IT Forensics for System Admins - Memory Acquisition II - Klaus Möller (DFN-CERT) Stefan Kelm (DFN-CERT)
IT Forensics for System Admins - Memory Acquisition II
- Klaus Möller (DFN-CERT)
- Stefan Kelm (DFN-CERT)
11:00 AM - 12:00 PM
Whatever malware is doing on a computer, the code to carry out its activity has to be in the random access memory (RAM). No wonder that investigating transient memory has become a hot topic in IT forensics over the last decade. The previous webinar covered the basic, agnostic technique of acquiring memory through the use of kernel drivers and copying tools. However, it required access to the operating system with root or administrator privileges. This webinar covers advanced techniques that will relinquish some of these preconditions and are in some cases be better suited for doing the job of memory acquisition.
Wednesday, December 15, 2021
Thursday, December 16, 2021
Friday, December 17, 2021
Saturday, December 18, 2021
Sunday, December 19, 2021

Monday, December 20, 2021
Tuesday, December 21, 2021
Wednesday, December 22, 2021
Thursday, December 23, 2021
Friday, December 24, 2021
Saturday, December 25, 2021
Sunday, December 26, 2021

Monday, December 27, 2021
Tuesday, December 28, 2021
Wednesday, December 29, 2021
Thursday, December 30, 2021
Friday, December 31, 2021
Saturday, January 1, 2022
Sunday, January 2, 2022

Monday, January 3, 2022
Tuesday, January 4, 2022
Wednesday, January 5, 2022
Thursday, January 6, 2022
Friday, January 7, 2022
Saturday, January 8, 2022
Sunday, January 9, 2022

Monday, January 10, 2022
Tuesday, January 11, 2022
Wednesday, January 12, 2022
Thursday, January 13, 2022
Friday, January 14, 2022
Saturday, January 15, 2022
Sunday, January 16, 2022