Computer Forensics

Explore the history and core practices of digital forensics, including preservation, identification, extraction, and reporting. Learn about admissible evidence, acquisition of hidden files, and the tools for Windows and Linux/Android.

Explore digital forensics and threat intelligence by learning techniques used in Windows and Linux forensics, with guidance for work with law enforcement and related organizations.

Master the core process of computer and digital forensics—collecting, preserving, analyzing, and reporting data to produce admissible digital evidence across devices and networks.

Examine data, acquire and collect evidence, preserve it using forensic methods; authenticate each item and maintain chain of custody throughout analysis and presentation to the authority.

Preserve digital evidence by performing a bit-by-bit copy to keep it authentic, prevent changes or copying, and verify integrity using cryptographic hashes that produce identical values for the same data.

Explore the two system shutdown states—forceful and graceful—and their forensic implications, including potential data loss, logged-in user information, network information, IP addresses, and connected devices.

Practice using the investigation and forensics toolkit to create logical drive images, copy evidence bit by bit, manage evidence trees, and analyze RAM processes for export.

Explore SleuthKit and Autopsy for forensic analysis of digital evidence, including browser history and deleted files. Create cases, configure sources from logical or physical drives, and generate reports.

Learn how live acquisition and incident response collect digital evidence from running systems, explore tools like Helix, EnCase, and Case Forensic, and perform memory and drive acquisitions with guided workflows.

Explore the forensics toolkit 2 workflow by capturing and saving memory images for investigation, handling encrypted files with decryption options, and examining the file system with a hex viewer.