Forensic Computing Course

Lesson 1 • Chain of Custody Fundamentals

Teaches proper evidence tracking, labeling, and transfer procedures. Establishes habits that protect evidence admissibility throughout a case.

Lesson 2 • The Forensic Investigation Process

Introduces the standard investigation lifecycle from identification through reporting. Provides a repeatable workflow students apply in every later chapter.

Lesson 3 • Legal and Ethical Obligations

Examines the legal authority, privacy constraints, and professional ethics governing investigators. Ensures compliant evidence handling from the first case.

Lesson 4 • Forensic Lab Setup and Safety

Covers physical and logical requirements for a forensic workspace. Students can configure a compliant lab environment before handling real evidence.

Lesson 1 • File Systems In Depth

Analyzes FAT, NTFS, ext, and APFS file system internals. Students locate metadata, slack space, and deleted entries within each system.

Lesson 2 • Data Deletion and Recovery Concepts

Explains how operating systems mark data as deleted without immediate erasure. Students understand recovery potential before attempting carving techniques.

Lesson 3 • Storage Media Types and Interfaces

Surveys magnetic, solid-state, optical, and flash storage technologies. Knowing media characteristics guides correct acquisition and recovery strategies.

Lesson 4 • Data Encoding and Representation

Covers binary, hexadecimal, ASCII, Unicode, and endianness. Accurate data interpretation depends on recognizing encoding schemes in hex editors.

Lesson 1 • Write Blocking and Evidence Integrity

Introduces hardware and software write blockers to prevent media modification. Proper use is mandatory before any acquisition begins.

Lesson 2 • Live and Volatile Data Acquisition

Addresses capturing RAM, running processes, and network state from live systems. Volatile data disappears at shutdown, making live acquisition a critical skill.

Lesson 3 • Hashing and Verification

Teaches MD5, SHA-1, and SHA-256 hashing to verify image integrity. Hash verification is the primary proof that evidence was not altered during acquisition.

Lesson 4 • Mobile and Cloud Evidence Acquisition

Covers logical, physical, and cloud-based acquisition for smartphones and online storage. Students adapt acquisition strategies to device lock states and cloud access constraints.

Lesson 1 • Keyword Searching and Indexing

Teaches index-based and raw keyword searches across forensic images. Efficient searching reduces analysis time and surfaces relevant evidence faster.

Lesson 2 • Timeline Construction and Analysis

Aggregates timestamps from multiple artifact sources into a unified event timeline. Timelines are the primary tool for reconstructing the sequence of events in a case.

Lesson 3 • Forensic Toolkits and Workflows

Surveys leading forensic platforms and establishes a repeatable analysis workflow. Tool selection and workflow discipline directly affect analysis accuracy and efficiency.

Lesson 4 • File and Metadata Analysis

Examines file headers, magic bytes, metadata fields, and embedded properties. Metadata often reveals creation context, authorship, and geographic location.

Lesson 1 • Windows Event Logs and Prefetch

Mines event logs and prefetch files for logon events, process launches, and errors. These artifacts corroborate or contradict user and system activity claims.

Lesson 2 • macOS and Linux Artifact Analysis

Targets plist files, bash history, syslog, and macOS unified logs. Cross-platform competency is essential as enterprise environments mix operating systems.

Lesson 3 • Windows Registry Forensics

Analyzes registry hives for user activity, program execution, and system configuration. The registry is one of the richest artifact sources in Windows investigations.

Lesson 4 • Browser and Internet Artifacts

Recovers browsing history, cache, cookies, and download records from major browsers. Internet artifacts frequently establish motive, intent, and communication patterns.

Lesson 1 • Packet Capture and Analysis

Teaches live capture and offline analysis of PCAP files using packet analyzers. Packet-level analysis reveals communication content, timing, and anomalies.

Lesson 2 • Network Evidence Correlation

Combines packet captures, logs, and host artifacts into a unified network timeline. Correlation across sources produces stronger, more defensible findings.

Lesson 3 • Intrusion and Exfiltration Detection

Identifies indicators of compromise, lateral movement, and data exfiltration in traffic. Recognizing attack patterns enables accurate incident scoping.

Lesson 4 • Log-Based Network Investigation

Analyzes firewall, proxy, DHCP, and DNS logs to reconstruct network activity. Logs provide evidence when full packet capture is unavailable.

Lesson 1 • Memory Forensics for Malware

Extracts injected code, hidden processes, and network connections from RAM dumps. Memory forensics uncovers fileless malware invisible to disk-based analysis.

Lesson 2 • Malware Artifact Identification

Locates persistence mechanisms, dropped files, and registry modifications left by malware. Identifying artifacts is the first step in scoping a compromise.

Lesson 3 • Dynamic Analysis in Safe Environments

Executes malware in isolated sandboxes to observe runtime behavior and network calls. Dynamic analysis reveals capabilities that static analysis cannot expose.

Lesson 4 • Incident Scoping and Containment Evidence

Uses forensic findings to define the incident boundary and affected asset inventory. Accurate scoping drives containment decisions and prevents reinfection.

Lesson 1 • Cross-Examination and Daubert Challenges

Prepares students for adversarial questioning and scientific reliability challenges. Anticipating challenges strengthens both testimony and underlying methodology.

Lesson 2 • Evidence Presentation and Exhibits

Covers creating annotated screenshots, timelines, and data visualizations as court exhibits. Clear exhibits help fact-finders understand complex digital evidence.

Lesson 3 • Writing for Technical and Non-Technical Audiences

Teaches adapting technical language for legal, executive, and technical readers. Audience-appropriate writing maximizes the impact and usability of findings.

Lesson 4 • Expert Witness Roles and Preparation

Explains the distinction between fact and expert witnesses and preparation requirements. Understanding the role prevents testimony errors that undermine case outcomes.