This live course is designed for investigators who want to learn more about Network Intrusions, the tools commonly used by attackers and the forensic artifacts commonly left behind. This course not only goes into the technical aspects of network intrusions, it also discusses the methodology commonly used by attackers. The course will begin with an overview of networking protocols and then quickly jump into session hijacking, network traffic capturing and the importance of collecting volatile data, which may contain significant forensic artifacts. The course combines forensic examinations with live response in a network environment. Students learn how to examine a compromised server or workstation in the field to obtain log files and forensic images of hard disk drives. Students examine server log files and forensic artifacts for evidence of the attacker's methods and activities. Students will perform many of the discussed attacks on a mock victim machine and then examine the machine using EnCase® to identify the artifacts they left behind when they performed the attack. Many different types of tools and programs will be discussed to get the investigator familiar with not only the methods used to gain unauthorized access, but what tools are commonly associated with those types of attacks so they can be readily identified during a forensic examination. Students will utilize and discuss a variety of tools, including the EnCase® Enterprise Edition (network version) and Network Intrusion EnScripts, for live incident response and collection of volatile data important to network intrusion investigations. Students will also discuss the use of the EnCase® Enterprise Edition for internal investigations over an organization's Local Area Network.

The course combines forensic examinations with live response in a network environment. Students learn how to examine a compromised server or workstation in the field to obtain log files and forensic images of hard disk drives. Students examine server log files and forensic artifacts for evidence of the attacker's methods and activities. The course will cover the following topics:
- Session hijacking
- Network traffic capturing (sniffing)
- Intrusion Detection Systems (IDS)
- Collection of volatile data from live system
- Viruses
- Trojans & Malware
- User-level rootkits
- Webserver attacks
- DCOM/RPC vulnerabilities
- SQL injection attacks
- Netbios/FileSharing attacks

FDR is the authorized Canadian training partner for Guidance Software Inc., delivering EnCase® training in Canada. FDR's team of Guidance Software Inc. EnCase Certified Examiner (EnCE)-certified instructors have trained hundreds of students, supporting their skill development in computer forensics and progression to obtain their EnCE designation.