Lesson 1Email an' messagin' sources: mailbox exports, SMTP/IMAP logs, message headers, retention policies, an' eDiscovery considerationsDis section cover evidentiary artifacts from email an' messagin' platforms, includin' mailbox exports, protocol logs, message headers, retention rules, an' eDiscovery workflows, emphasizin' authenticity, completeness, an' defensible collection methods.
Mailbox export formats an' toolsSMTP, IMAP, an' POP server logsMessage headers an' routin' analysisRetention an' legal hold policiesChat an' collaboration message exportsLesson 2Overview a corporate evidence sources: endpoints, servers, cloud services, email, collaboration platforms, VPN, DLP, MDM, SaaS audit logsDis section provide a structured overview a common corporate evidence sources, includin' endpoints, servers, cloud services, email, collaboration platforms, VPN, DLP, MDM, an' SaaS audit logs, highlightin' typical artifacts an' access considerations.
Endpoint an' workstation artifactsServer an' database log sourcesEmail an' collaboration platformsNetwork, VPN, an' remote access logsDLP, MDM, an' SaaS audit telemetryLesson 3Data Loss Prevention an' SIEM sources: DLP alerts, content inspection logs, SIEM event correlation an' alert ingestion patternsDis section explore Data Loss Prevention an' SIEM platforms as rich evidence sources, explainin' DLP alert artifacts, content inspection logs, SIEM normalization, correlation rules, alert triage, an' ingestion patterns dat affect completeness an' investigative value.
DLP alert metadata an' contextContent inspection an' fingerprint logsEndpoint versus network DLP signalsSIEM parsin' an' normalization rulesCorrelation rules an' use case tunin'Lesson 4Application an' collaboration platform evidence: audit logs, file version history, sharin' links, access control lists, an' collaboration metadataDis section focus pon application an' collaboration platforms, examin' audit logs, file version histories, sharin' links, access control lists, an' collaboration metadata, an' explain how fi reconstruct user actions an' document access durin' investigations.
Application audit an' activity logsFile version history an' recoverySharin' links an' external accessAccess control lists an' permissionsCollaboration comments an' reactionsExportin' workspace audit trailsLesson 5Prioritization an' legal holds: determin' scope fi quick preservation an' issuin' legal hold notices to custodians an' systemsDis section explain how fi prioritize evidence an' implement legal holds, definin' scope, identifyin' custodians an' systems, issuin' hold notices, coordinatin' wid legal an' HR, an' monitorin' compliance to prevent spoliation or premature deletion.
Scopin' custodians an' data sourcesRisk-based evidence prioritizationDraftin' an' issuin' legal holdsCoordinatin' wid legal an' HR teamsMonitorin' hold compliance an' releaseLesson 6Network an' perimeter evidence: VPN logs, proxy an' firewall logs, NetFlow, packet captures (PCAP) collection an' retention best practicesDis section detail network an' perimeter evidence, includin' VPN, proxy, an' firewall logs, NetFlow an' IPFIX records, an' packet captures, wid guidance pon time synchronization, storage, filterin', an' defensible retention strategies fi investigations.
VPN authentication an' session logsProxy an' web gateway activity logsFirewall rule hits an' deny eventsNetFlow an' IPFIX flow recordsPacket capture collection strategiesNetwork log retention an' rotationLesson 7Mobile an' removable media: mobile device backups, MDM logs, USB device histories an' Windows device installation logsDis section examine mobile devices an' removable media as evidence sources, focusin' pon backup artifacts, MDM telemetry, USB usage traces, an' Windows device installation logs, wid attention to preservation, validation, an' chain a custody.
iOS an' Android backup artifactsMDM inventory an' compliance logsUSB connection an' usage historiesWindows device installation recordsPreservin' mobile an' USB evidenceLesson 8Server an' cloud data acquisition: API-based exports, storage snapshots, object storage metadata, cloud provider audit logs (AWS CloudTrail, Azure AD logs, Google Workspace audit)Dis section address server an' cloud data acquisition, includin' API-based exports, storage snapshots, object storage metadata, an' cloud provider audit logs, wid emphasis pon scopin', throttlin', integrity validation, an' cross-region evidence preservation.
Agent-based versus agentless collectionHypervisor an' VM snapshot workflowsObject storage metadata an' versionsAWS CloudTrail an' CloudWatch logsAzure AD an' Microsoft 365 auditsGoogle Workspace an' GCP audit logsLesson 9Endpoint data acquisition: live response, volatile data capture, full disk imagi'n, filesystem snapshotsDis section cover endpoint data acquisition techniques, includin' live response, volatile memory capture, full disk imagi'n, an' filesystem snapshots, wid attention to tool selection, minimizin' impact, an' maintainin' evidentiary integrity an' documentation.
Live response triage proceduresRAM an' volatile data collectionFull disk an' partition imagi'nFilesystem an' volume snapshotsValidatin' hashes an' chain a custody