3 days of poking into the computer for forensic means...

Started on my training on the 10th. Yeah, today is the 12th.

The conference on the first day had 2 tracks, the management track and the technical track. It was conducted in the Microsoft Convention Centre in Wan Chai. I found the technical track being really vendor-specific, focusing on open source forensic tools, mobile forensics tools and incident response methodologies.

The speakers spoke about establishing centre of excellence for the providing of computer forensics certification. From my view, I felt that they were trying to establish a standard for computer forensics training, since certain individuals were tend to capitalizing on the term for commercial value. The speakers were highlighting the need for further development into the cooperation between the academia, law enforcement and corporate services. There was also discussions on the further setting up of a online discussion forum for computer forensics investigators. I guess my favourites for the day were the ones on virtual worlds, governance and penetration testing via the Helix3 boot-up CD. There was a drinks cum networking session after the talks had ended, but drats, I forgot to bring my business cards to Hong Kong..

Day 2 -3 was to be conducted at the University of Hong Kong. It was my first time there, and yes, it gives a campus feel to me. However, I still felt that the design of RMIT was way better. In these 2 days, I took up the technical trainings on Mobile Devices Forensics, relating to generic phones and the iPhone. Up till now, I'm starting to feel the track on the iPhone is a real leltdown. The generic one was pretty much more hands on.

Next up, was the tracks I took relating to Incident Response, oh wow! what can I say, but the speaker really rocked. Really alot of new insights and knowledge gained from the speaker, Anthony Lai. The hands-on session pretty much rocked too, since it was much more technical in showing how to push out an exploits on a system vulnerability, as well as inserting the payload into the exploit. Lotsa interesting tools were also demostrated. I think that the extremely cool tool was the one called Maltego. As for today, I did Malware Analysis in the morn, and though the track was conducted in Mandarin, for a potato like me...IT DEFINITELY ROCKED! And yet I thought that I would be understanding nuts about it. I kinda regret not going for the second session on Windows Memory Forensics, since the current iPhone Forensics one that I'm in kinda sucks...pretty much close to zero hands on 1hr 10mins into the track. At least the track on Malware Inspection was really interesting with all the hands on.

Once the conference ends, I should be flying back home on the 13th. And its back to work for me. ;P

Pictures for the Course:



High Technology Crime Investigation Association Conference 2008