Digital Forensics and Investigation Course

Lesson 1 • Legal and Ethical Framework

Examines the legal authority, privacy considerations, and ethical obligations governing investigations. Ensures students operate within lawful and professional boundaries.

Lesson 2 • Types of Digital Evidence

Categorizes volatile, non-volatile, and network-based evidence and their forensic significance. Prepares students to recognize evidence types in subsequent technical chapters.

Lesson 3 • The Investigative Process Model

Introduces structured investigation models and their phases from identification to reporting. Provides a repeatable framework students apply throughout the course.

Lesson 1 • Storage Media and Architecture

Covers HDD, SSD, flash, and optical media architectures and their forensic implications. Connects hardware knowledge to evidence acquisition strategies in later chapters.

Lesson 2 • Data Encoding and Representation

Teaches binary, hexadecimal, ASCII, and Unicode encoding as applied to forensic data interpretation. Students decode raw bytes to identify evidence artifacts accurately.

Lesson 3 • Deleted Data and Slack Space

Explains how deletion works at the file system level and where residual data persists. Students recover evidence from unallocated space and slack regions.

Lesson 1 • Chain of Custody Management

Establishes documentation, labeling, and storage protocols that preserve evidence integrity. Students create and maintain custody records that withstand legal scrutiny.

Lesson 2 • Principles of Forensic Acquisition

Defines write-blocking, bit-for-bit imaging, and verification hashing as core acquisition principles. Establishes the integrity standards all subsequent acquisition tasks must meet.

Lesson 3 • Disk and Drive Imaging

Covers imaging formats such as raw, E01, and AFF and the tools used to create them. Students perform full and targeted disk acquisitions with verified integrity.

Lesson 4 • Live and Volatile Data Acquisition

Addresses capturing RAM, running processes, and network state from live systems. Prepares students to collect ephemeral evidence before system shutdown.

Lesson 1 • Browser and Application Artifacts

Extracts browsing history, cached files, cookies, and application-specific artifacts. Students reconstruct user online behavior and application usage patterns.

Lesson 2 • Windows Registry Forensics

Examines registry hive structure, key locations, and artifact types relevant to investigations. Students extract user activity, program execution, and device connection evidence.

Lesson 3 • Windows Event Log Analysis

Covers event log formats, critical event IDs, and log correlation techniques. Students reconstruct logon events, privilege escalation, and security incidents from logs.

Lesson 4 • Windows Memory and Paging Analysis

Covers pagefile, hibernation file, and memory dump analysis for Windows systems. Students recover passwords, process data, and network connections from memory artifacts.

Lesson 1 • Protocol Analysis and Reconstruction

Covers TCP/IP, DNS, HTTP, and email protocol analysis for evidence extraction. Students reconstruct sessions and communications from raw packet captures.

Lesson 2 • Network Forensics Fundamentals

Introduces network evidence sources, capture points, and the forensic value of traffic data. Connects network concepts to the broader investigative process established earlier.

Lesson 3 • Network Timeline and Attribution

Synthesizes network evidence into timelines and maps activity to specific hosts or users. Students produce attribution reports supported by corroborated network artifacts.

Lesson 4 • Intrusion Detection and Log Analysis

Examines firewall, IDS, proxy, and DHCP logs for indicators of compromise. Students correlate log sources to identify attack timelines and affected hosts.

Lesson 1 • Mobile Application Artifact Analysis

Examines social media, browser, and productivity app databases for user activity evidence. Students extract and interpret app-specific artifacts to reconstruct user behavior.

Lesson 2 • Location and Sensor Data Analysis

Analyzes GPS logs, Wi-Fi location data, and cell tower records to establish device location history. Students map movement patterns to support investigative timelines.

Lesson 3 • Mobile Platform Architectures

Compares iOS and Android architectures, file systems, and security models relevant to forensics. Provides the platform knowledge required for targeted extraction and analysis.

Lesson 4 • Communication and Messaging Artifacts

Extracts SMS, MMS, call logs, and third-party messaging app data from mobile devices. Students recover deleted messages and reconstruct communication timelines.

Lesson 1 • Static Malware Analysis

Covers file hashing, string extraction, PE header analysis, and signature-based detection. Students characterize malware without execution to safely identify indicators of compromise.

Lesson 2 • Dynamic Malware Analysis

Examines sandbox execution, behavioral monitoring, and network traffic generated by malware. Students observe malware actions in a controlled environment to document its capabilities.

Lesson 3 • Malware Artifact Documentation

Structures findings from malware investigations into indicators of compromise and formal reports. Students produce deliverables usable by both technical teams and legal stakeholders.

Lesson 4 • Malware Classification and Behavior

Categorizes malware types by behavior, persistence mechanism, and forensic footprint. Establishes the taxonomy students use when identifying malware artifacts in investigations.

Lesson 1 • Case File Management and Closure

Covers case file organization, evidence return or disposal, and post-case review processes. Students close investigations in a manner that satisfies legal and organizational requirements.

Lesson 2 • Expert Witness Roles and Responsibilities

Defines the expert witness role, qualification standards, and duties of impartiality. Students understand their obligations before, during, and after providing expert testimony.

Lesson 3 • Evidence Presentation Techniques

Covers visual aids, timelines, and exhibit preparation for presenting digital evidence. Students create clear exhibits that support investigative conclusions for diverse audiences.

Lesson 4 • Courtroom Testimony Skills

Prepares students for direct examination, cross-examination, and handling adversarial questioning. Students practice delivering clear, composed, and credible testimony under pressure.