Data forensics Course

Lesson 1 • Legal and Ethical Obligations

Covers admissibility requirements, chain-of-custody rules, and investigator ethics. Ensures students understand constraints that govern every forensic action.

Lesson 2 • What Is Digital Forensics

Defines digital forensics, its scope, and its role in investigations. Anchors all subsequent technical work in a clear disciplinary framework.

Lesson 3 • Setting Up a Forensic Lab Environment

Guides students through hardware, software, and procedural requirements for a forensic workspace. Establishes safe, repeatable conditions for all lab exercises.

Lesson 4 • The Forensic Investigation Lifecycle

Maps the end-to-end process from incident identification to case closure. Students gain a repeatable mental model for structuring any investigation.

Lesson 1 • File System Internals

Examines FAT, NTFS, ext4, and APFS file system structures in forensic detail. Students extract metadata and locate artifacts within each file system.

Lesson 2 • Encoding, Hashing, and Data Integrity

Introduces character encoding, cryptographic hashing, and integrity verification. Students apply hashing to confirm evidence authenticity throughout an investigation.

Lesson 3 • File Deletion and Data Remnants

Explains what happens at the file system level when files are deleted. Students understand where recoverable data persists after deletion.

Lesson 4 • Storage Media Architecture

Explains HDD, SSD, and flash storage internals relevant to forensic recovery. Connects physical media behaviour to evidence acquisition strategies.

Lesson 1 • Principles of Forensic Acquisition

Establishes write-blocking, bit-for-bit imaging, and verification as non-negotiable acquisition standards. Grounds all acquisition techniques in defensible methodology.

Lesson 2 • Disk and Media Imaging

Covers tools and procedures for imaging HDDs, SSDs, and removable media. Students produce and verify forensic images in standard formats.

Lesson 3 • Cloud and Remote Evidence Collection

Explains legal authorisation and technical methods for collecting cloud-hosted evidence. Students document cloud acquisition to satisfy chain-of-custody requirements.

Lesson 4 • Mobile Device Acquisition

Covers logical, file system, and physical extraction methods for smartphones and tablets. Students select the appropriate extraction level based on device state.

Lesson 1 • Windows Timeline and Filesystem Artifacts

Analyzes NTFS timestamps, $MFT, $LogFile, and $UsnJrnl for file activity reconstruction. Students build chronological timelines of file system events.

Lesson 2 • Windows Event Log Analysis

Covers EVTX log structure, key event IDs, and log correlation techniques. Students identify authentication, process, and security events relevant to investigations.

Lesson 3 • Windows Registry Forensics

Examines registry hives as a rich source of user and system activity artifacts. Students parse hive files to extract configuration, usage, and timeline data.

Lesson 4 • Browser and Communication Artifacts

Extracts browsing history, cached files, cookies, and email artefacts from Windows systems. Students link online activity to user accounts and timeframes.

Lesson 1 • Malware Artifact Extraction

Guides extraction of suspicious executables, strings, and configuration data from memory. Students produce actionable indicators of compromise from memory evidence.

Lesson 2 • Memory Architecture and Acquisition Review

Reviews virtual memory layout, process address spaces, and kernel structures relevant to analysis. Connects acquisition concepts from Chapter 3 to analytical techniques.

Lesson 3 • Process and Network Analysis in Memory

Identifies running processes, DLL loads, and active network connections within memory images. Students detect anomalous processes and hidden network activity.

Lesson 4 • Code Injection and Rootkit Detection

Covers common injection techniques including DLL injection, process hollowing, and reflective loading. Students identify injected code regions and rootkit hooks.

Lesson 1 • Intrusion and Attack Pattern Recognition

Teaches recognition of scanning, exploitation, and lateral movement patterns in network data. Students map observed traffic to known attack stages.

Lesson 2 • Network Evidence Sources and Collection

Catalogues packet captures, NetFlow, firewall logs, and proxy logs as primary network evidence. Students identify which sources answer specific investigative questions.

Lesson 3 • Packet Capture Analysis

Covers deep packet inspection, protocol dissection, and stream reassembly techniques. Students reconstruct sessions and extract transferred files from PCAP evidence.

Lesson 4 • Wireless and VoIP Forensics

Addresses evidence collection and analysis from Wi-Fi and voice-over-IP communications. Students apply packet analysis skills to wireless and telephony evidence.

Lesson 1 • Cloud Storage and Collaboration Forensics

Covers artefact recovery from cloud storage, email, and collaboration platforms. Students use API access and local sync artefacts to reconstruct cloud activity.

Lesson 2 • IoT and Wearable Device Forensics

Introduces evidence sources from smart home devices, wearables, and connected vehicles. Students identify and collect IoT artefacts relevant to investigations.

Lesson 3 • Mobile Operating System Internals

Examines iOS and Android file system layouts, data partitions, and app storage models. Students navigate mobile storage structures to locate forensic artefacts.

Lesson 4 • Mobile Application Artifact Analysis

Targets SQLite databases, plist files, and cached data within mobile applications. Students extract communication, location, and activity artefacts from app data.

Lesson 1 • Case Management and Documentation

Establishes systems for managing evidence, notes, and communications throughout a case. Students apply documentation practices that protect case integrity from start to finish.

Lesson 2 • Timeline and Visualisation Techniques

Covers tools and methods for creating visual timelines and evidence maps. Students produce graphics that clarify complex event sequences for any audience.

Lesson 3 • Preparing for Expert Testimony

Prepares students for deposition and courtroom testimony as a forensic expert witness. Students practise explaining methodology and defending findings under cross-examination.

Lesson 4 • Writing for Non-Technical Audiences

Teaches plain-language translation of technical forensic findings for legal and executive readers. Students rewrite complex findings without sacrificing accuracy.