Every digital forensics investigation rests on the same foundation: evidence that is collected carefully, handled consistently, and explained honestly. Digital forensics is the practice of identifying, preserving, analysing, and reporting on data from computers, phones, networks, and online services, so that what happened in a digital environment can be reconstructed and trusted.
You'll start with what digital forensics is and the main branches of the field, then walk through the forensic process from first response to final report. Along the way you'll learn what counts as digital evidence, why chain of custody and documentation matter, and how legal and ethical rules shape every decision an investigator makes.
This is the first module in the course. The next one, Evidence Acquisition & Imaging, builds on these ideas by showing how to capture data without changing it.
A beginner-friendly welcome to the field that assumes no prior knowledge of digital investigations or IT, covering what digital forensics is and where this course series is headed.
General investigation methods and the skills needed to carry them out, applicable to both online and offline investigations.
A National Center on Forensics training session on how digital evidence is used in investigations, how it spreads, and why research and standards matter in the field.
A SANS talk on the foundational skills that apply across all areas of digital forensics, introducing the FOR308 Digital Forensics Essentials course.