0%

Explore Courses Defend What Matters

English 日本語
$ USD ¥ JPY
Contact Us
0
Sign In Create Account
Start Learning

Your Bag

Digital Forensics Fundamentals

04 Digital Forensics

Digital Forensics Fundamentals

Learn to acquire and handle digital evidence so that what you find survives scrutiny, in a report or in court.

Levels
04
Skill Range
Beginner → Expert
Track
Digital Forensics
Lifetime Access
Enroll Now Explore Courses
Digital Forensics Fundamentals
From 207CREDS

Forensics is not primarily about tools. It is about doing things in an order you can defend afterwards. This course covers the forensic process end to end: identification, preservation, acquisition, analysis, and reporting. You will learn write blocking and imaging with dd, FTK Imager, and Guymager, verify integrity with hashing, and maintain a chain of custody that stands up to challenge. File systems get proper coverage, because knowing how NTFS, ext4, and APFS allocate and delete determines what you can recover. Volatile against non-volatile evidence, order of volatility, and live acquisition trade-offs are covered directly. You will complete a full examination of a prepared disk image and produce a written report.

Curriculum

Learning Path

Each level is enrolled separately. Work through them in order, or start at the level that matches your experience.

  1. Level 01

    Beginner

    207 CREDS

    Purpose

    Acquire evidence in an order you can defend, since forensics is process before it is tools.

    Outcome

    You can acquire a forensic image and prove it was not altered.

    What You'll Learn
    • Use write blocking and image a disk with dd, FTK Imager, or Guymager.
    • Verify integrity with hashing before and after.
    • Maintain a chain of custody that stands up to a challenge.
  2. Level 02

    Intermediate

    450 CREDS

    Purpose

    Understand file systems, because how they allocate and delete decides what you can recover.

    Outcome

    You can recover deleted files and explain the file system behaviour.

    What You'll Learn
    • Study how NTFS, ext4, and APFS store and delete files.
    • Recover a deleted file and explain why it was recoverable.
    • Interpret timestamps and what each one actually records.
  3. Level 03

    Advanced

    663 CREDS

    Purpose

    Handle volatile evidence and the order of volatility correctly.

    Outcome

    You can choose the right acquisition method under pressure.

    What You'll Learn
    • Distinguish volatile from non-volatile evidence and prioritise capture.
    • Weigh the trade-offs of live acquisition against a clean shutdown.
    • Decide the right acquisition approach for a given scenario.
  4. Level 04

    Expert

    1,036 CREDS

    Purpose

    Complete a full examination and produce a report that holds up to scrutiny.

    Outcome

    You can run a full examination and defend the findings.

    What You'll Learn
    • Examine a prepared disk image end to end.
    • Document each step so the analysis can be reproduced.
    • Write findings clearly enough to stand up in a report or in court.