GTU Study
KHUDKIBOOK
CYBER FORENSIC AND
FREE PDF
2715904
Code: 2715904
Credits: 5
Semester 1
CS
Cyber Forensic and Incident Response
Get the full GTU study material, English & Gujarati textbook PDFs, syllabus curriculum, and solved previous year question papers.
×
English Book & Chapters
English Book Coming Soon
We are working hard to add this material. Stay tuned for updates!
Follow on Instagram for Updates
×
GTU Previous Year Papers
Papers Coming Soon
We are working hard to add this material. Stay tuned for updates!
Follow on Instagram for UpdatesCyber Forensic and Incident Response Syllabus — Unit-wise Content
The official GTU curriculum for Cyber Forensic and Incident Response (subject code 2715904) as prescribed for CS · Semester 1 divides the course into 15 units, covering 80 listed topics. The unit-wise breakdown below is read from the GTU syllabus document for this subject code, so you can check what the course actually covers before deciding which papers to attempt.
Download the official syllabus PDF (2715904)Unit 1 Introduction to the Incident Response Process
- What Is a Computer Security Incident?
- What Are the Goals of Incident Response?
- Who Is Involved in the Incident Response Process?
- Incident Response Methodology
- Pre-Incident Preparation
- Detection of Incidents
- Initial Response
- Formulate a Response Strategy
- Investigate the Incident
Unit 2 Preparing for Incident Response
- Overview of Pre-incident Preparation
- Identifying Risk
- Preparing Individual Hosts
- Preparing a Network
- Establishing Appropriate Policies and Procedures
- creating a response toolkit Establishing an Incident Response Team
Unit 3 After Detection of an Incident
- Overview of the Initial Response Phase
- Establishing an Incident Notification Procedure
- Recording the Details after Initial Detection
- Incident Declaration
- Assembling the CSIRT
- Performing Traditional Investigative Steps
- Conducting Interviews
- Formulating a Response Strategy
Unit 4 Live Data Collection from Windows Systems and Unix Systems
- Creating a Response Toolkit
- Storing Information Obtained during the Initial Response
- Obtaining Volatile Data
- Performing an In-Depth Live Response
- Is Forensic Duplication Necessary?
Unit 5 Forensic Duplication
- Forensic Duplicates As Admissible Evidence
- Forensic Duplication Tool Requirements
- Creating a Forensic Duplicate of a Hard Drive
- Creating a Qualified Forensic Duplicate of a Hard Drive
Unit 6 Collecting Network-based Evidence
- What Is Network-based Evidence?
- What are the goals of network monitoring?
- Types of Network Monitoring
- Setting Up a Network Monitoring System
- Performing a Trap-and-Trace Using tcpdump for Full-Content Monitoring
- Collecting Network-based Log Files
Unit 7 Evidence Handling
- What Is Evidence?
- The Challenges of Evidence Handling
- Overview of Evidence-Handling Procedures
Unit 8 Computer System Storage Fundamentals
- Hard Drives and Interfaces
- Preparation of Hard Drive Media
- Introduction to File Systems and Storage Layers
Unit 9 Data Analysis Techniques
- Preparation for Forensic Analysis
- Restoring a Forensic Duplicate
- Preparing a Forensic Duplication for Analysis In Linux
- Reviewing Image Files with Forensic Suites
- Converting a Qualified Forensic Duplicate to a Forensic Duplicate
- Recovering Deleted Files on Windows Systems
- Recovering Unallocated Space
- Free Space, and Slack Space Generating File Lists
- Preparing a Drive for String Searches
Unit 10 Investigating Windows Systems
- Where Evidence Resides on Windows Systems
- Conducting a Windows Investigation
- File Auditing and Theft of Information
- Handling the Departing Employee
Unit 11 Investigating Unix Systems
- An Overview of the Steps in a Unix Investigation
- Reviewing Pertinent Logs
- Performing Keyword Searches
- Reviewing Relevant Files
- Identifying Unauthorized User Accounts or Groups
- Identifying Rogue Processes
- Checking for Unauthorized Access Points
- Analyzing Trust Relationships
- Detecting Trojan Loadable Kernel Modules
Unit 12 Analyzing Network Traffic
- Finding Network-Based Evidence
- Generating Session Data with tcptrace
- Reassembling Sessions Using tcpflow
- Reassembling Sessions Using Ethereal
- Refining tcpdump Filters
Unit 13 Investigating Hacker Tools
- What Are the Goals of Tool Analysis?
- How Files Are Compiled Static Analysis of a Hacker Tool
- Dynamic Analysis of a Hacker Tool
Unit 14 Investigating Routers
- Obtaining Volatile Data Prior to Powering Down
- Finding the Proof
- Using Routers as Response Tools
Unit 15 Writing Computer Forensic Reports
- What Is a Computer Forensics Report?
- Report Writing Guidelines
- A Template for Computer Forensic Reports
Study on Android App:
