Computer Forensics and Digital Forensics Masterclass PRO+

Define cybercrime as illegal activity using computers or networks, per the DOJ definition, highlighting motives like financial gain and crimes such as fraud, unauthorized access, and malware.

Identify insider and external attacks as the main cybercrime sources, noting economic espionage. Classify cybercrimes into three device-use categories, including weapon use such as DDoS and ransomware, and crime facilitation.

Explore common cybercrime forms, from malware distribution and ransomware to phishing and identity theft, and learn how attackers exploit vulnerabilities to steal data and money.

Learn how to assemble a field response kit for digital forensics, covering documentation, evidence handling, storage, and essential hardware and software tools for on-site collection.

Explore the differences between live and postmortem acquisitions, preserving volatile memory data and paging files, imaging devices, and documenting steps for court-ready digital forensics.

Master memory forensics as a ram-based tool for incident response and malware analysis, revealing fileless and memory-resident threats with no trace left behind.

Explore the main categories of digital forensics, including computer, mobile, network, database, and memory forensics. Understand how evidence is acquired, preserved, and used in law enforcement, civil litigation, and e-discovery.

Explore computer forensics as a forensically sound discipline that identifies, preserves, recovers, analyzes, and presents digital evidence for crime and civil cases, following acquisition, examination, analysis, and reporting.

Learn mobile forensics as a branch of digital forensics, focusing on Android and iOS forensics, data extraction from phones, and meeting forensic soundness and Daubert standard requirements.

Explore how mobile forensics evolved from manual evidence collection to hardware–software toolkits that recover logical and physical data from devices, including field-ready rugged tools, faraday bags, and chip-off techniques.

Learn database forensics to prevent and detect data breaches by examining database contents, metadata, and access timestamps, using forensic techniques to uncover transactions and illicit activity.

Perform forensic data analysis across structured data and unstructured data to detect financial crime patterns. Use exploratory data analysis, hypotheses, and cross-database integration with data visualization.

Explore the basics of computer networking and network protocols, including nodes, addressing, session management, capturing data, analyzing and exploiting new protocols.

Explore the TCP/IP protocol suite and the four-layer model—link, internet, transport, and application. Learn how IP addresses, ports, and protocols like HTTP, SMTP, and DNS enable global network communication.

Explore how emails are sent and received over a network, detailing layered architecture, network protocols such as smtp, imap, and pop3, content parsers, and the user interface in email applications.

Explain the PDU structure with header, payload, and optional footer for error checking, and outline the internet protocol suite layers, tcp/udp headers, ports, ipv4/ipv6, and mac addresses in frames.

Data transmission routes application data into an IP packet, then an Ethernet frame. ARP resolves MAC addresses, and a switch forwards the frame to the destination.

Describe how IP routing moves data across networks by encapsulating IP packets in Ethernet frames, using routing tables and ARP to reach the destination via routers and a default gateway.

Trace the history of storage media, file systems, and operating systems, and learn how forensics preserves data and evidence across laptops, desktops, mobile and cloud storage.

Discover what digital evidence is, including electronically stored information, user and machine created data, and metadata across devices and networks, and learn where it resides and how to collect it.

Develop the mindset of a digital forensics investigator by solving puzzles, improvising under challenging tools, maintaining integrity and confidentiality, and handling forensics images with hash verification.

Explore the definition, objectives, usage, and certifications of digital forensics, and learn how digital evidence is collected, preserved, and presented in court from computing devices.

Explore how cybercrime uses computing devices and networks, including insider and external attacks such as economic espionage, and attack modes like DDoS and ransomware for financial gain.

Explore digital forensics categories, including computer, mobile, network, and database forensics, and the role of evidence collection and analysis in law enforcement and civil discovery.

Explore anti-forensics as the enemy of digital forensics investigators, examining hacker groups, VPNs and trim-enabled SSDs that hinder evidence collection, and the need for trained personnel and DPR plans.

Encrypting creates confidentiality through keys and algorithms, with BitLocker and PGP, while masking IP/MAC, proxy chaining, Tor, and bulletproof hosting complicate digital forensics.

Explore how timestamping in NTFS metadata and the MFT enables anti-forensics tactics, revealing altered birth, modified, and access times used by attackers to hide tools and delay detection.

Explore optical and removable storage media, from magnetic tape and floppy disks to CDs, DVDs, and Blu-ray, covering laser wavelengths, capacities, and writable formats, plus cloud storage and forensics implications.

Learn about flash storage media, including Nand and Nor flash memory and EEPROMs, and explore the USB evolution from 1.1 to 4.0 with high-speed transfer.

Explore nand flash memory and flash memory cards, compare sd and micro sd formats, and learn about capacity ranges up to 256gb and the role of memory card readers.

Explore hard disk drives as fixed storage media, contrasting mechanical drives with moving parts to solid-state drives, and trace evolving interfaces like IDE, EIDE, and SATA relevant to forensic investigations.

Discover how SSDs store data with NAND flash and a controller, using SATA data and power, and learn NAND types (SLC, MLC, TLC, QLC) with wear leveling, error correction, trim.

Explore evidence acquisition and disk imaging with FTK Imager, including full and logical images, and ensure data integrity via checksums and hashing forensically.

Learn how Linux names and recognizes storage devices, including sda, sdb, sdc, hda, and partitions like sda1, to accurately identify drives for forensic analysis and data management.

Identify storage devices with the fdisk command and perform forensic acquisition using dc3dd, while employing hardware or software write blockers in Kainos to protect evidence integrity.

Maintain evidence integrity by generating MD5 and SHA-1 hashes before and after acquisition, then verify the DC3D image matches the original hash to ensure data fidelity.

Explore how dc3dd extends dx with bitstream acquisition, forensic imaging, on-the-fly hashing, and hash verification to ensure data integrity.

Master large forensic images with DC 3D by splitting into manageable parts and verifying integrity with SHA1 hashes and log files to preserve evidence across storage media.

Use Guymager, a graphical forensic imaging tool for Linux, to acquire and clone forensic images. Utilize case management, metadata, and verification features, including MD5, SHA1, SHA256, and expert witness format.

Capture volatile memory on Windows with ftk imager to obtain a ram image containing active processes, encryption keys, malware, open network connections, and user activity traces.

Master memory forensics with the volatility framework, extracting volatile ram and paging file data for incident response, and practice with windows memory images.

Begin with volatility plugins through a hands-on memory forensics session, analyzing a Windows XP memory dump with imageinfo and the PS list plugin to identify the OS profile.

Analyze memory-resident processes with volatility PS3, PS scan, and PS view to reveal parent-child relationships, detect hidden or terminated processes, and compare visibility across scans.

Analyze memory with volatility to detect terminated, active, and hidden network connections using con scan and sockets, identify suspicious port 6666 activity and potential malware indicators for incident response.