Digital forensics Course

Lesson 1 • Types of Digital Evidence

Surveys volatile, non-volatile, and network-based evidence categories. Prepares learners to recognise evidence sources before acquisition begins.

Lesson 2 • The Forensic Investigation Process

Introduces the standard phases: identification, preservation, analysis, and reporting. Provides the procedural backbone applied throughout the entire course.

Lesson 3 • Legal and Ethical Foundations

Examines admissibility standards, chain of custody, and investigator ethics. Ensures every technical action taken later meets evidentiary requirements.

Lesson 4 • Defining Digital Forensics

Covers the discipline's definition, history, and relationship to cybersecurity and law. Anchors all subsequent technical work in a clear professional framework.

Lesson 1 • Principles of Forensic Imaging

Explains bit-for-bit copying, hashing, and verification to ensure image integrity. Establishes the technical standard all acquisition tasks must meet.

Lesson 2 • Cloud and Remote Evidence Acquisition

Explores legal holds, API-based collection, and provider cooperation for cloud data. Prepares learners for evidence sources that lack physical media.

Lesson 3 • Live System and Memory Acquisition

Teaches volatile data capture from running systems before shutdown destroys evidence. Connects directly to later memory analysis techniques.

Lesson 4 • Mobile Device Acquisition

Addresses logical, file-system, and physical extraction methods for smartphones and tablets. Highlights platform-specific challenges that affect evidence completeness.

Lesson 1 • Anti-Forensic Techniques and Detection

Identifies methods used to hide, destroy, or obfuscate evidence at the storage level. Learners learn to detect and counter these techniques during analysis.

Lesson 2 • Deleted File Recovery

Demonstrates how deletion works at the file system level and how data persists. Learners apply carving and metadata techniques to recover deleted content.

Lesson 3 • File System Fundamentals

Explains partition tables, volume structures, and common file system types. Provides the structural knowledge needed to navigate forensic images accurately.

Lesson 4 • NTFS Forensic Artefacts

Examines MFT records, journal files, and alternate data streams unique to NTFS. These artefacts reveal file history and anti-forensic attempts on Windows systems.

Lesson 1 • Browser and Internet Artefacts

Extracts history, cache, cookies, and download records from major browsers. Connects web activity to user intent and potential data exfiltration.

Lesson 2 • Windows Timeline and Activity Cache

Analyses the ActivitiesCache database and Windows Timeline for recent user actions. Provides a chronological view of document access and application use.

Lesson 3 • Windows Registry Forensics

Maps registry hive structure and identifies keys that record user and system activity. Registry analysis underpins most Windows artefact investigations.

Lesson 4 • Windows Event Log Analysis

Teaches parsing of Security, System, and Application logs to reconstruct events. Learners correlate log entries to build timelines of attacker or user behaviour.

Lesson 1 • Network Connections in Memory

Extracts active and recently closed network connections from memory structures. Links processes to external communications for threat attribution.

Lesson 2 • Memory Acquisition Methods

Reviews tools and techniques for capturing RAM from live and hibernated systems. Addresses acquisition fidelity issues that affect downstream analysis accuracy.

Lesson 3 • Memory Architecture and Structures

Explains virtual address spaces, kernel structures, and process memory layout. This foundation is required to interpret memory analysis tool output correctly.

Lesson 4 • Malware and Rootkit Detection in Memory

Applies DKOM detection, hook analysis, and YARA scanning to identify advanced threats. Learners produce memory-based indicators of compromise for incident response.

Lesson 1 • Intrusion and Exfiltration Detection

Identifies attack patterns, lateral movement, and data exfiltration in network evidence. Learners apply traffic baselining and anomaly detection to real-world scenarios.

Lesson 2 • Log-Based Network Investigation

Analyses firewall, proxy, DNS, and DHCP logs to trace host activity and connections. Complements packet analysis when full captures are unavailable.

Lesson 3 • Packet Capture and Analysis

Teaches filtering, stream reassembly, and protocol dissection using capture analysis tools. Learners reconstruct sessions and extract transferred files from packet data.

Lesson 4 • Wireless Network Forensics

Covers 802.11 frame analysis, rogue access point detection, and wireless log review. Extends network forensics skills to environments where wired captures are unavailable.

Lesson 1 • Incident Timeline Construction

Correlates artefacts from disk, memory, and network to build a unified attack timeline. Timeline accuracy directly determines the quality of the final forensic report.

Lesson 2 • Dynamic Malware Analysis

Executes malware in isolated sandboxes and monitors system and network behaviour. Produces behavioural indicators that complement static findings.

Lesson 3 • Static Malware Analysis

Applies file hashing, string extraction, and PE header analysis to suspicious files. Learners identify indicators of compromise without executing malware.

Lesson 4 • Malware Classification and Behaviour

Categorises malware families and describes their forensic footprints on host and network. Provides the threat context needed to guide targeted artefact collection.

Lesson 1 • Technical Writing for Forensics

Develops precise, jargon-controlled writing that conveys complex findings to varied audiences. Clarity in writing directly affects how evidence is understood by decision-makers.

Lesson 2 • Expert Witness Preparation

Prepares learners to qualify as expert witnesses and present findings under examination. Covers deposition, direct examination, and cross-examination strategies.

Lesson 3 • Case Study: End-to-End Report Production

Applies all reporting skills to a realistic scenario from evidence receipt to final report. Learners receive structured feedback to reach professional reporting standards.

Lesson 4 • Forensic Report Structure and Standards

Defines required report sections, objectivity standards, and documentation best practices. A well-structured report is the primary deliverable of every forensic engagement.