About Digital Forensics
Digital forensics is the practice of finding, preserving, and analysing digital
evidence so it can be trusted in an investigation, and this course follows the order
a real case unfolds. It starts with Digital Forensics Fundamentals
(the forensic process, chain of custody, and legal basics), then
Evidence Acquisition & Imaging, where you learn to capture
drives without altering them and prove it with hashes.
Next comes File Systems & Data Recovery, covering how NTFS, FAT,
and ext4 store data and how deleted files are recovered. From there,
Windows Forensics covers the registry, event logs, and prefetch,
while Linux & macOS Forensics covers system logs, shell history,
and persistence.
Memory Forensics covers RAM capture and analysis with Volatility,
and Network Forensics covers packet captures, flow data, and tracing
intrusions with tools like Wireshark and Zeek.
Finally, Mobile & Cloud Forensics covers Android, iOS, and cloud
service evidence, Malware Analysis & Incident Response brings
timelines and triage into live incidents, and Reporting & Expert
Evidence shows how to document findings so they stand up in court or a
boardroom.
Content
10 modules
01
Digital Forensics Fundamentals
The forensic process from identification to reporting, chain of custody, legal and ethical rules, and how to handle evidence so it holds up.
Chain of CustodyACPO PrinciplesForensic Process
02
Evidence Acquisition & Imaging
Preserving evidence with write blockers, creating forensic disk images, and proving integrity with cryptographic hashes.
Write BlockersFTK ImagerHashing
03
File Systems & Data Recovery
How NTFS, FAT, and ext4 store data, and how to recover deleted files, slack space, and carved artifacts.
NTFSFile CarvingAutopsy
04
Windows Forensics
Investigating Windows systems through the registry, event logs, prefetch files, shellbags, and user activity artifacts.
RegistryEvent LogsPrefetch
05
Linux & macOS Forensics
Examining Unix-like systems: ext4 and APFS artifacts, system logs, shell history, and persistence mechanisms.
ext4 / APFSLog AnalysisShell History
06
Memory Forensics
Capturing and analysing RAM to find running processes, network connections, injected code, and credentials.
VolatilityRAM CaptureProcess Analysis
07
Network Forensics
Reconstructing activity from packet captures, flow data, and logs to trace intrusions and data exfiltration.
WiresharkPCAPZeek
08
Mobile & Cloud Forensics
Acquiring and analysing data from Android and iOS devices, plus cloud service logs and account artifacts.
AndroidiOSCloud Logs
09
Malware Analysis & Incident Response
Triaging suspicious files, building timelines, and running a digital forensics investigation during a live incident.
Timeline AnalysisYARAIncident Response
10
Reporting & Expert Evidence
Documenting findings clearly, writing forensic reports, and presenting evidence as an expert in legal or corporate settings.
Forensic ReportsDocumentationExpert Testimony
What You Can Do After This Course
By the end of the curriculum you'll have worked through 5 hands-on projects and
covered the core of what a junior digital forensics or DFIR analyst role expects. Concretely,
you'll be able to:
Follow a forensic process: handle evidence correctly from seizure to report, with a documented chain of custody.
Acquire evidence safely: image drives and devices with write blockers and verify integrity with cryptographic hashes.
Recover and analyse data: read NTFS, FAT, and ext4 structures, recover deleted files, and carve artifacts.
Investigate operating systems: pull evidence from the Windows registry and event logs, and from Linux and macOS logs and histories.
Analyse memory and networks: capture RAM, inspect processes with Volatility, and trace activity through packet captures.
Examine mobile and cloud sources: acquire Android and iOS data and interpret cloud account and audit logs.
Respond and report: build timelines, triage malware, and write clear forensic reports you can defend as an expert.