Cyber Crime Investigation Course

Lesson 1 • Roles and Responsibilities of Investigators

Defines the duties of law enforcement, corporate, and private investigators. Establishes professional boundaries that govern all subsequent practical work.

Lesson 2 • Networking and Internet Fundamentals

Introduces TCP/IP, DNS, and routing concepts essential for tracing digital activity. Builds the technical vocabulary required for evidence collection chapters.

Lesson 3 • Cybercrime Taxonomy and Threat Landscape

Defines cybercrime types, from network intrusions to financial fraud. Provides the classification vocabulary used throughout the course.

Lesson 1 • Nature and Types of Digital Evidence

Explains volatile vs. non-volatile data and where evidence resides across devices. Grounds students in evidence categories before collection techniques are introduced.

Lesson 2 • Scene Documentation and Sketching

Applies photography, sketching, and logging to capture the digital crime scene. Accurate scene records support reconstruction and courtroom presentation.

Lesson 3 • Legal Authority for Evidence Collection

Covers warrants, consent, and exigent circumstances that authorize seizure. Ensures investigators act within legal bounds before touching any device.

Lesson 4 • Chain of Custody Management

Establishes documentation practices that track evidence from seizure to court. Proper custody records prevent evidence challenges during prosecution.

Lesson 1 • Data Carving and Recovery

Recovers files from unallocated space using header and footer signatures. Carving extends evidence recovery beyond what the file system records.

Lesson 2 • Forensic Workstation Setup and Tools

Configures a forensically sound examination environment with validated tools. A proper lab setup is the foundation for all analysis tasks in this chapter.

Lesson 3 • Forensic Report Writing

Structures findings into clear, defensible forensic reports for legal audiences. Report quality directly affects the usability of evidence in court.

Lesson 4 • File System Analysis

Examines FAT, NTFS, ext, and APFS structures to locate and recover files. File system knowledge enables investigators to find hidden and deleted data.

Lesson 1 • Intrusion Detection and Alert Triage

Evaluates IDS and IPS alerts to distinguish true positives from false positives. Alert triage focuses investigative resources on confirmed malicious activity.

Lesson 2 • Packet Analysis and Protocol Decoding

Decodes TCP, UDP, HTTP, DNS, and SMTP traffic to reconstruct sessions. Protocol-level analysis reveals attacker commands and exfiltrated data.

Lesson 3 • Network Traffic Capture Techniques

Covers SPAN ports, network taps, and promiscuous-mode capture for evidence collection. Proper capture setup ensures complete and unaltered traffic records.

Lesson 4 • Network Attack Timeline Reconstruction

Synthesizes packet, log, and alert data into a chronological attack narrative. Timelines are essential for prosecution and incident response reporting.

Lesson 1 • OSINT Methodology and Source Evaluation

Establishes a structured OSINT collection cycle and source reliability framework. Methodology prevents bias and ensures defensible intelligence products.

Lesson 2 • Building and Documenting Subject Profiles

Synthesizes OSINT data into structured subject profiles with source citations. Profiles support arrest warrants, prosecutions, and further investigative steps.

Lesson 3 • Social Media and Forum Investigation

Extracts identifiers, connections, and behavioral patterns from social platforms. Social media evidence links online personas to real-world suspects.

Lesson 4 • Dark Web and Anonymization Network Research

Investigates Tor, I2P, and similar networks while maintaining investigator anonymity. Understanding anonymization tools is critical for tracing darknet offenders.

Lesson 1 • Safe Analysis Environment Setup

Builds isolated virtual lab environments for safe malware execution and study. Containment prevents accidental infection and preserves evidence integrity.

Lesson 2 • Dynamic Malware Analysis Techniques

Executes malware in a controlled environment to observe runtime behavior. Dynamic analysis reveals network callbacks, file drops, and registry modifications.

Lesson 3 • Linking Malware to Attacker Infrastructure

Correlates command-and-control domains, IPs, and code similarities to attribute attacks. Infrastructure attribution connects malware samples to known threat actors.

Lesson 4 • Static Malware Analysis Techniques

Examines file headers, strings, imports, and hashes without executing the sample. Static analysis yields quick indicators before dynamic execution is attempted.

Lesson 1 • Financial Records and Transaction Analysis

Interprets bank records, payment processor logs, and transaction histories for fraud evidence. Financial records establish the money trail linking suspects to victims.

Lesson 2 • Online Fraud Schemes and Typologies

Examines phishing, business email compromise, card fraud, and investment scams. Typology knowledge enables rapid scheme recognition and evidence targeting.

Lesson 3 • Cryptocurrency Tracing and Blockchain Analysis

Traces Bitcoin and altcoin transactions across public blockchains to follow illicit funds. Blockchain transparency enables financial attribution even through mixing services.

Lesson 4 • Coordinating with Financial Intelligence Units

Establishes protocols for sharing financial evidence with regulatory and intelligence bodies. Coordination amplifies investigative reach and accelerates prosecutions.

Lesson 1 • Cross-Examination Preparation

Prepares investigators to defend methodology and findings under adversarial questioning. Anticipating defense strategies strengthens the credibility of expert testimony.

Lesson 2 • Case File Assembly and Review

Organizes all evidence, reports, and legal documents into a structured case file. A complete, well-indexed file reduces errors and strengthens prosecutorial arguments.

Lesson 3 • Expert Witness Qualification and Role

Explains the standards for qualifying as a digital forensics expert witness. Understanding the expert role prepares investigators for effective courtroom contributions.

Lesson 4 • Presenting Digital Evidence in Court

Teaches methods for displaying exhibits, demonstrating tools, and explaining technical findings. Clear presentation ensures judges and juries understand digital evidence.