ODSC East 2022 - "Data Science for Digital Forensics & Incident Response (DFIR)"

[19/04/22] Apr 19, 2022 Jess Garcia - One eSecurity Twitter: j3ssgarcia - LinkedIn: garciajess

Thank you to all the ODSC East 2022 assistants! In this workshop we have been able to solve a case through an investigation using DS4N6 tools: CHRYSALIS and DAISY

We have created this page so you can get all the resources needed for the workshop in an easy way.

This is the recommended place to do the exercises during the workshop.

Binder is a code repository that contains at least two things:

• Code or content that you’d like people to run. This might be a Jupyter Notebook that explains an idea, or an R script that makes a visualization.

• Configuration files for your environment. These files are used by Binder to build the environment needed to run your code. For a list of all configuration files available, see the Configuration Files page.

Click on the button to get started!

Binder has an allowed 10-minute downtime period, if you spend more time without interacting, the kernel will die.

Colab allows you to write and execute Python in your browser, with:

• Zero configuration required
• Unordered List ItemFree access to GPUs
• Easy sharing

Whether you're a student, a data scientist or an AI researcher, Colab can make your work easier.

To get the workshop notebook, here are the instructions you must follow:

1. Log into your Google account
2. Click here to open Colab
3. Click on 'GitHub'
4. Write this url: https://github.com/ds4n6/odsc_notebooks_colab
5. Click on the search button
6. Click on 'ODSC_TheStolenSzechuanSauceCase_colab.ipynb'

DAISY (DFIR Data Science & AI) is a Virtual Machine designed to carry out Data Science and Machine/Deep Learning Analysis on DFIR data. Click here to get all the information and download it

IMPORTANT

You can download this and this files and execute them in your DAISY to get all the information (notebooks, evidence, etc.) you need to run the ODSC workshop in your computer. The steps are:

1. Place both scripts on the Desktop
2. Double-click on Daisy Update.desktop.desktop
3. The evidence will be downloaded in /home/ds4n6/Desktop/Data and the notebooks will be downloaded in /home/ds4n6/Desktop/Notebooks/Demo_notebooks

We will release a new DAISY version soon including a Machine Learning library (D4ML) and an updated CHRYSALIS version.

NOTE: We have create a PDF file with the solutions of the workshop. You can download it here