You will also learn over 50 operating system commands that you will need when you are doing hands-on auditing and forensics with these systems. Students taking this course for certification or for graduate credit should be aware that while the information is foundational, this is a fast paced, high information flow overview course and the student is expected to master the material. This is the key class to understanding what to look for on a computer system and how to do it. The course material builds on the system-specific information from the second half of the Understanding and Auditing Information Systems course to really drill down into critical security elements of operating systems. The student will also learn the fundamentals of forensics - what to do when you find something that requires further investigation during an audit.
Forensic investigation plays a major role in the identification phase of computer incident handling.
To the extent possible, the focus of the forensics aspect of the course is based on the commands supplied by the operating system to investigate a potential compromise. This course points out the limitations of that approach, and suggests creating alternative toolkits.