Digital Forensics Masterclass Complete Computer Forensics

Set up your digital forensics lab by installing VirtualBox and adding a Kali Linux virtual machine with the installer image and hardware settings.

Learn to download and configure a Windows virtual machine in VirtualBox, including Windows ISO setup, RAM and CPU settings, storage, network NAT, and optional shared folders.

Clarify the distinction between digital forensics and its subfield, computer forensics, and learn the procedural steps to identify, gather, preserve, extract, interpret, document, and present evidence from computing equipment.

Explore the roles and responsibilities of a forensic investigator, including evidence handling, data recovery, incident response, and presenting findings in court, with emphasis on forensic readiness and legal compliance.

Explore the forensic investigation process and its importance, covering pre-investigation, investigation, and post-investigation phases, prioritizing digital evidence integrity, compliance with local laws, and a repeatable, well-documented workflow.

Plan and budget a computer forensic lab, covering lab size, security, and licensing. Define the investigation team and hardware and software needs, including workstations, write blockers, and tools like Wireshark.

Explore the investigation phase in digital forensics, covering documenting the electronic crime scene, search and seizure, evidence preservation, data acquisition, and data analysis for legally admissible evidence.

Document actions, organize information, and prepare concise, technically sound forensic reports for prosecutors and judges. Explain how conclusions are reached and present evidence, procedures, and expert-witness testimony in court.

Master data acquisition fundamentals, detailing live versus static data, volatile data like ram and caches, non-volatile data from disks, order of volatility, and essential best practices for evidence handling.

Examine logical, sparse, and bit-stream data acquisition, including selective file capture, deleted data, and bit-by-bit drive copies, plus raw, proprietary, and advanced forensic formats.

Apply a systematic, forensically sound data acquisition methodology to collect volatile and non-volatile data while preserving evidence integrity for admissibility in court.

Explore network forensic fundamentals, capturing, recording, and analyzing network events to trace breaches, identify intrusion paths, post mortem and real-time log analysis, and key network and wireless attacks.

Explore event correlation concepts and types in digital forensics, mapping alarms, alerts, and other events on a log management platform to reveal root causes.

Identify indicators of compromise by analyzing firewall logs, IDS logs, honeypot logs, router logs, and DHCP logs to reveal security breaches.

Master network forensics with Wireshark on Kali Linux, capturing live traffic on eth0, analyzing DNS queries, three-way TCP handshakes, and HTTP/TLS traffic to understand packets, ports, and protocols.

Explore malware basics, definitions, and types like viruses, worms, trojans, rootkits, adware, and spyware, along with distribution methods and core components.

Explore malware forensics fundamentals and static versus dynamic analysis in a controlled, isolated environment to identify malware type, behavior, origin, and impact.

Perform static malware analysis by inspecting executables without executing them, using file fingerprinting, online scanning, string searches, packing detection, portable executable metadata, and hash-based integrity checks.

explore dynamic malware analysis by outlining two approaches—monitoring host integrity and observing runtime behavior—and summarize pre-execution baselining of forensic workstations and key system and network analysis tools.

Explore memory forensics basics by analyzing memory dumps and the memory architecture, including processor cache, main memory (RAM), auxiliary storage, and key registry hives.

Cover memory forensics acquisition methods by outlining raw, crash dump, hibernation file, page file, and VMware snapshot formats; emphasize choosing techniques by scenario and operating system.

Explore how email crime investigation extracts and analyzes messages for evidence. Learn key crimes, such as spamming and phishing, and the seven-step workflow.

Analyze email headers to verify sender identity and detect spoofing by examining time stamps, from and to fields, message IDs, subject, mime, received headers, return path, spf, and dkim.

Perform practical email header analysis using a mail viewer to verify DMARC, SPF, and DKIM authentication and trace delivery paths for digital forensics.

Open your Windows virtual machine and launch the internal tools. Use proc mode to view processes and the process tree, inspect PID, parent ID, path, and modules, and save findings.

Explore ram map, disk view, and vm map to analyze memory usage, processes, page tables, physical addresses, bad sectors, and auto run and tcp view details in a Windows vm.

Explore Autopsy, an open-source digital forensics platform, by installing it on a Windows VM, creating a case, and using multi-user cases, timeline analysis, and keyword search to recover deleted files.

Learn how to clone a crime scene pendrive with FTK Imager, create a forensic image, verify integrity with hash matching, and capture memory for evidence.