 Welcome back everyone. Today we're going to be talking a little bit about what you can actually do with digital forensics. You've started this course, you might be thinking, you know, what am I going to learn and how can I actually use it? So today we're going to go through, you know, what exactly do you learn whenever you're doing digital forensics and how can you use the skills that you acquire? What can you do afterwards? So digital forensics actually teaches you quite a few things. First we learn how computers work. So this is the basis of doing digital forensics. You have to understand how computers work, how mobile devices work, how networks work to be able to investigate these digital devices. So the biggest thing is that you actually learn how computers and computer systems work. We understand or we learn how data is stored and accessed. Going through digital forensics you get a good understanding of how data actually travels through the internet, how and where it's stored on our devices, on our phones, in the cloud, all of these different things. And that type of information, if you understand how and where data is stored, then a lot of other things start to make sense to you. For example, legislation that's being passed in your country. So if you understand where data is at and what information is contained in that data, then you get a better understanding of maybe how you want to protect that data or how that data should be accessible to other people. Next, how to manage large amounts of data efficiently. So all of us now, we live in a very connected society. We all have computers and a lot of devices and we have a lot of data, some of which is personal information that we don't want shared. Some of it is not personal information, maybe we don't mind sharing. But we get a better understanding of how to first off manage and organize that data and find the things that we're looking for easier. So imagine your computer at home. You might have files from the last 10 years. If you want to find something from 10 years ago, how do you actually find it efficiently and quickly? So whenever you think about digital forensics, it gives you this better idea about where data is located, how you can find that data very quickly and efficiently where other people who aren't used to managing data, it might take them a much longer time. And all of this, of course, translates into our everyday lives. I want to find a cacao talk message very quickly that contains an address. Well, how can I do that faster than my friends, basically? Doing digital forensic investigation also teaches you how to think logically. So whenever we're doing an investigation, we have to go through this logical thought process to put all of this potentially evidence together to support or deny some hypothesis that's being made. And we'll talk about what a hypothesis is in later lectures. But this logical thought process, going through and thinking about how do we actually make arguments? How do we actually convince people that we are right? How do we know that we are right? A lot of people don't actually formally think about why they think something is correct. So doing digital forensic investigation helps you to at least see the argumentation structure whenever you're making some claim. It helps you to have kind of this evidence-based reasoning or learn how to do evidence-based reasoning that's usually much stronger than what kind of an average person would have who has never studied either argumentation or investigation before. So digital investigation also can change the way a little bit that you think. You'll be much more objective. You'll be much more evidence-seeking afterwards. And hopefully, you'll be more correct. And that's really what we're aiming for, is correctness and truth. How to connect concepts. So again, doing digital investigation, we need to look at a lot of different data sources, maybe a lot of different devices, a server in another country, a computer maybe in Korea, a cell phone in the United States, something like that. And we have to take all of the evidence we can get from all of these different sources and make essentially a story out of it. Can we reconstruct the story of what happened in this particular cyber crime or this particular criminal action that we're investigating? So we need to think about, or we do think about, how to actually connect these concepts. And if you don't practice actually putting concepts together, most people tend to make a lot of assumptions about what happened, rather than, again, finding evidence and thinking logically about it. So learning digital investigations also helps you connect sometimes relatively abstract concepts, connect them a little bit better or gives you the practice to connect them a little bit better. And then finally, how to write and communicate. So writing and communication is extremely important everywhere in the world now. We are a country, I guess developed countries, are the countries that are producing ideas. We need to produce and very clearly state what our ideas and what our positions are. And doing digital forensic investigation, like I said, teaches you how to think critically, but it also helps you to actually communicate in your writing and your statements in a very objective and hopefully truthful and supported type of way. So writing and communication is extremely important again everywhere. We need to be able to communicate effectively with whatever we're trying to say. And doing digital forensic investigation helps you to communicate because every sentence you're saying or claiming, every claim you make, you have to ask yourself, is this actually true or not? And in our everyday lives, we don't usually assess whether our claims, every single claim is true or not. Sometimes we make assumptions, but with digital investigations you can't. So it kind of helps you to communicate more effectively and be able to support again your reasoning. So all of these things, how computers work, how data is stored in access, how to manage large amounts of data efficiently, how to think logically, how to connect concepts and how to write and communicate effectively. This is what you learn in digital forensic investigations. But where can you apply this? Well, you can apply it literally in everything, right? Everyone is using technology now. Everyone is trying or is communicating constantly. We are constantly communicating with each other and we don't communicate very well. A lot of people make assumptions. You've probably heard a lot about fake news now. How can fake news exist if everyone was actually critically analyzing and looking for evidence for every claim that was being made? It couldn't, right? So not only do these skills help you in your everyday life to assess and evaluate in a reasonable way what's true and what's false, but it also helps you potentially in every job. So think about any job that you might want to get. You will have to communicate effectively with people. You will have to evaluate whether what you are telling them and what they are telling you is true or not. So every basically job and your daily lives will be greatly affected by the skills that you can learn in here. So I don't want you to think that by learning digital forensics you are only getting technical skills. If you want to do digital forensic investigation well, you really have to evaluate how you think and question why you think the way you do. And if you can do that, you will be extremely effective at basically any job. So although we are teaching you the technical skills, it applies to a much greater area than just digital forensic investigation. So what can you do with digital forensics? Just like I said, almost anything really. Whenever you learn digital forensic investigation, if you have a good idea about how computers work, maybe you learned a little bit of programming, maybe you know how computers work, maybe you know how data is stored and you are interested in legislation, well, I mean you can apply those areas, that knowledge to many, many different areas that are extremely needed right now. For example, information security. So common jobs, I have a list here, are for example, police. Police in almost every country have at least one digital forensic laboratory. But some police officers, for example, Korea, there's over a thousand digital investigators in Korea and it's growing. I mean it's not getting smaller. And they are constantly busy with the amount of cyber crime they have. So law enforcement, police have a lot of positions doing digital forensic investigation, prosecution services as well. Almost every country has a digital forensic lab or group within the prosecutors to validate and check examples. Korea also has a relatively large digital forensics analysis team in the Korean prosecution. Military. Military in almost every country are investing heavily in cyber, the cyber area. Now a lot of that is offensive. So trying to get people who can hack and potentially defend against hacking. So security experts. But some of that, or quite a bit of it, is also including digital forensic investigations. Most of those people need to know how to do some digital forensics if they want to understand how different attacks work. So in the military digital forensics and offensive and defensive security usually go hand in hand, but there are a lot of positions in military in basically every country. Intelligence services. So for example like the CIA in Korea, the NIS, they also have digital forensic investigations services or essentially the same type of services as police, military and prosecutors. Because all of our communications now are over some sort of digital media. They are very interested for example if a terrorist is planning something using their cell phone, well if we get the cell phone how can we actually extract that information about the terrorist's plan. So intelligence services also invest a lot in information security and digital investigations. That's kind of the government sector. So most government organizations probably have at least some interest in digital forensic investigation directly. And that's not even considering the information security aspects other than just direct digital forensic investigator jobs. Law firms, consulting companies and banks. So banks obviously are very interested in securing their products and they get hacked a lot whenever they actually have some sort of hack happen they have to understand what happened so they can fix it. And that is digital forensic investigation. Most banks tend to either hire full time a consulting company that does digital forensics or more likely they have some digital forensic capability in house. So they hire digital forensic investigators to help secure their infrastructure. Law firms and consulting companies are usually doing something like e-discovery which is very similar to digital forensics with usually the goal of a civil investigation rather than a criminal investigation which we'll talk about. But law firms, most of the big law firms in Korea and the rest of the world have digital forensic investigators working full time and providing services. Corporate investigators, so think about all of the big, any big company basically any actually medium to large company they're all using technology and they're all usually using that technology for human resources management financial transaction management, things like that and they are constantly being targeted by cyber criminals. So a lot of big companies also hire digital forensic experts internally to help secure their network and investigate whenever something happens. So again, that's most companies. So most companies, most government organizations law firms, consulting, banks that's most business basically in every country. Reporters and NGOs, so reporters now I see a lot of non-governmental organizations and also agencies, reporting agencies using some type of digital forensics. For example, there was a recent case where ABC analyzed a tablet. They got a tablet from a desk they analyzed the tablet to try to extract the information from the tablet. Now, did they use digital forensic practices for that? I actually don't know. I didn't hear how they extracted it. If they just turned it on and started looking through everything then how do we know that they didn't change something? Nobody asked that question because it's not a criminal investigation they just found it and they claim they had it. But whenever they found that tablet or any digital device they should be going through very specific digital forensic investigation processes to extract the information in a way that everyone can trust. Now, whether they did that or not, I'm not sure but reporters also needs to understand technology and how to manage data whenever they're running a story about technology. Non-governmental organizations are also working a lot more related to cyber crime. They understand, for example, networking and how networks work and they are helping to push governments to combat cyber crime a little bit more effectively whenever they think government is ignoring different problems online. So there's been a lot of that recently. And then there's also just the normal jobs I can say normal, the jobs that have existed for a long time PC technician and network administrator. If you understand digital forensic investigation well then that means you understand computers. If you understand computers well enough then you can be someone who fixes computers or manages networks or anything related to technology basically. And again, almost every company has some sort of PC technician or network administrator in their company. It's an extremely important job and with digital forensic investigation skills you not only understand how to manage computers but also how to secure them potentially and investigate them if something happens. So there's a lot more value if you understand how to do digital forensic investigations whenever you're doing administration. So don't overlook basically the older technical jobs as well. Digital forensic investigation helps you to get in any of those areas. Like I said, almost all companies use computers for service or finances. All companies that are providing a service you know even by email if their email gets hacked they need some investigation so they understand how that happened and how they can secure themselves in the future. Everyone is using technology that means that basically any type of area you want to go in that's related to technology digital forensic investigation can help you to get started in that area. So here I have how do you start a lot of people actually recently have asked me how do you start in digital forensic investigations and I would say if you have no experience at all the CompTIA A-plus certification about basically hardware and software computer hardware and software is a good certification to start if you want or I also recommend a book called Operating System Concepts which I have in the slides. That book will tell you basically everything about how a computer in general works and then it gets to some more advanced topics later but it's an incredibly good book to get started with. So if you want to read that book it's a little bit long but if you want to read that book before you actually get started with this course I highly recommend Operating System Concepts and it's currently in its ninth edition. This course you can read that book of course to get an idea of how computers and how technology works but you don't have to. In this course we assume that you don't really know anything about maybe even computers or digital forensics we try to take you from the basics the very beginning. So if you don't know anything, no problem you can still follow this course okay but if you have that background information it will help you a lot in the future. There's also a book a free online book it's the Linux Leo Beginners Guide and that book helps to teach you about Linux command line how the Linux Operating System works and how Linux command line works. I also recommend learning Windows command line so a lot of people know how to use Windows very few people know how to use Windows command line so basically for starting I highly recommend understanding how computers work and a little bit about operating systems Linux Mac OS X and also Linux command line Windows command line okay the reason I recommend command line is because the more you know the more you know about it the more you'll be able to navigate a computer and basically do a lot of more advanced topics or more advanced commands later yeah so a lot of people ask me do I need to know programming to be a digital forensic investigator do I need to be a professional programmer or a mathematician or some sort of you know math wizard no not necessarily I know a lot of digital forensic investigators that know almost no programming at all now if you learn programming of any type it will help you right I write a lot of programs that help me do digital forensic investigations but I don't have to so if you are interested in programming I highly recommend you try to learn at least one language just to get an idea of it it will also help you again programming skills help you in a lot of different areas as well but you don't have to learn programming to be a good digital forensic investigator but it will help you okay if you want to learn some programming languages I just have an order of the languages that I tend to use top to bottom recommended languages would be linux bash again linux command line and writing scripts for that python, html5 and javascript go is a relatively new language so go lang c and c++, pearl and java so I use linux bash by far the most and then python kind of second html and javascript is probably third go lang probably fourth and then how do you keep learning basically read a lot our last lecture is how to do research in digital investigations so we'll talk more about that later and also practice a lot there are a lot of challenges there are a lot of challenges provided online digital investigation challenges from digital investigation communities so if you want to practice doing digital forensics go online search for digital forensic challenge and you'll find a lot of different kind of like online exams they give you these problems you have to use digital forensic techniques to solve them and they are a really good way for networking to meet other people who are interested in digital forensics and also a good way to learn what current problems are and how to solve those problems so I highly recommend trying to build a community or getting involved in the community and learning as much as possible so we'll talk about all of these topics much more throughout the course, thank you very much