SATPC0030764 Tab 04 4 SOW.pdf

STATEMENT OF WORK

NASA OIG

Office of Investigations/Cyber Crimes Division

KAPE Training

Scope

NASA Office of Inspector General Office of Investigations, Cyber Crimes Division will host its annual training event in Austin, TX from August 22 – 24, 2023. This training will include

NASA OIG Office of Investigations Cyber Crimes Division personnel.

We are requesting Kroll Artifact Parser and Extractor (KAPE) Training which is an efficient and highly configurable incident response and digital forensics triage program that can target nearly any device or storage location, find forensically useful artifacts, and parse them within a few minutes. KAPE is a powerful tool in the NASA OIG Cyber Crimes Division (CCD) “toolbelt”.

However, in order to use KAPE in conjunction with digital evidence related to civil or criminal legal matters, forensic examiners must be able to show that they have properly trained on the tool’s validation and use in digital forensic operations. As such, the requested training will serve to instruct 100% of CCD personnel in the deployment and application of the KAPE tool suite. In addition, the training will provide all CCD forensic examiners with eight (8) continuing education hours, as well as subject them to a forensic proficiency examination, both of which are required to meet tri-annual Council of Inspectors General for Integrity and Efficiency (CIGIE)

Quality Standards for Digital Forensics (QSDF) requirements for all personnel engaged in digital forensic operations.

Requirements

• KAPE Training for 15 (fifteen) Investigators

• Certification examination for 15 (fifteen) Investigators

• Travel expenses for 3 (three) KAPE Trainers

Deliverables or Delivery Schedule

Morning Session:

Lab Zero – “Collecting the Software” (Downloading the labs, E01, class material, etc.)

File system

• MFTECmd: $MFT and $J

File/folder opening

• LECmd: Lnk files

• JLECmd: Jump list files

• ShellBags Explorer: Shell bags

Evidence of Execution

• Prefetch

Registry

• Registry Explorer

Lab 1 “Processing $MFT, $J, and $Boot - Using the MFTECmd”

Lnk Files

Lab 2 – “File and Folder Opening – LECmd”

Jump Lists

Lab 3 – “File and Folder Opening – JLECmd and JumpList Explorer”

(Possibly with time permitting)

Shell Bags

Lab 4 – “File and Folder Opening – ShellBags Explorer”

Afternoon Session:

• Understanding the applications of KAPE targets and modules

• Instruction for how to build targets and modules catered to environments you face most often

• Learning about target and module options

• Exploring the capabilities of KAPE’s graphical interface

• Targeting specific options such as VSC’s, containers and SFTP

• Taking advantage of KAPE’s clear command line structure

• Running a hands-on investigation lab to produce actionable intelligence in 15 minutes or less

Accessing evidence

Lab 1 “Collecting Files with gKAPE”

Lab 2 “Processing Files with gKAPE”

Lab 3 “Creating a Custom Target”

Lab 4 “Capstone”

Lab 5 “KAPE GitHub Repos” (Take Home)

Following training each attendee will be provided with the link to take the KAPE Certification exam. The exam period will be open for a period of 60 days from the close of the training session.

Place of Performance

JW Marriott (downtown)

Austin, TX

Period of Performance

August 23, 2023