About This Course
This intensive 12-week program trains students to become digital forensics and incident response specialists. The course combines theoretical knowledge with extensive hands-on practice using industry-standard tools and real-world scenarios. Students will master forensic techniques across multiple platforms including Windows, Linux, macOS, and mobile devices, culminating in a full-scale incident response simulation.
Prerequisites:
- Strong understanding of operating systems (Windows, Linux, macOS)
- Basic networking and security concepts
- Familiarity with command line interfaces
- Understanding of file systems and data structures
- Previous cybersecurity training recommended
Skills You'll Gain
File System Analysis
Linux Endpoint Forensics
Windows Endpoint Forensics
macOS Forensics
Mobile Forensics (Android/iOS)
Memory Forensics
Disk Image Analysis
Incident Response
Evidence Collection
Timeline Reconstruction
Malware Detection
Professional Reporting
Course Syllabus
MBR & GPT Analysis Techniques
FAT32 File System Structure & Analysis
NTFS File System Deep Dive
EXT File System Analysis (Linux)
File Carving Techniques & Tools
Hands-On: Diskrupt Lab - Fixing Damaged Disks
Deleted File Recovery Methods
File System Timestamps & Metadata Analysis
Linux Incident Surface & Attack Vectors
Linux Process Analysis & Investigation
Linux System Logs Investigation (/var/log)
Live Linux Forensics: Memory Analysis
Running Processes & Network Connections
Linux Persistence Mechanisms
Lab: IronShade - Linux Compromise Assessment
Linux Artifact Collection & Preservation
Windows Incident Surface & Compromise Indicators
Windows User Accounts & Profile Analysis
User Activity Tracking & Timeline Reconstruction
Windows Registry Forensics Fundamentals
Application Forensics & Evidence Collection
Windows Event Log Analysis
Prefetch & Superfetch Analysis
NTFS $MFT & Journal Analysis
Windows Network Forensics & Connections
Registry Deep Dive & Advanced Analysis
Malware Trace Detection & Analysis
Lab: Logless Hunt - DFIR After Cleared Logs
Scenario: Blizzard - Multi-System Investigation
Windows Persistence Mechanisms
PowerShell & WMI Forensics
Windows Memory Artifacts
macOS File System Basics (APFS/HFS+)
macOS User Data & Preferences Analysis
System Logs & Unified Logging
Application Forensics on macOS
macOS Keychain & Security Analysis
Safari & Browser Forensics
Lab: Mac Hunt - macOS Compromise Investigation
macOS Timeline & Activity Reconstruction
Mobile Acquisition Techniques: Logical, File System, Physical
Android File System & Partition Analysis
Android Forensics Basics & Tools
Extracting Communication Data: Calls, SMS, Chats
Android App Data & Database Analysis
Android System Logs Investigation
Identifying Malicious APK Behavior
Android Rooting & Security Bypass Detection
iOS Acquisition Methods & Limitations
iOS File System & Backup Analysis
iOS Keychain & Secure Storage Forensics
iMessage & Communication Forensics
iOS App Data & Plist Analysis
Jailbreak Traces & Security Analysis
iTunes Backup Forensics
iOS Timeline & User Activity Analysis
Memory Acquisition Techniques & Tools
Volatility Framework Essentials
Windows Memory Analysis: Processes & Threads
DLL & Handle Analysis
Memory-based Malware Detection
Network Connections in Memory
Registry Analysis from Memory
Memory Dump Creation & Validation
Advanced Windows Memory Analysis
User Activity Analysis from Memory
Network Connections & Malware Detection
Linux Memory Analysis: Processes & Persistence
Linux Memory Malware Traces
Lateral Movement Evidence in Memory
Credential Theft Detection
Advanced Volatility Plugins & Techniques
Cold System Forensics Concepts
Forensic Imaging Best Practices
Hash Verification & Chain of Custody
Autopsy Framework Introduction
Timeline Analysis with Autopsy
File Recovery & Carving with Autopsy
Keyword Searching & Indexing
Report Generation & Documentation
Advanced Disk Image Investigation Techniques
Multi-Source Evidence Correlation
Case Study: DiskFiltration - Windows Data Exfiltration
Case Study: ExfilNode - Hunting Exfiltration Footprints
Advanced Timeline Analysis
Network Evidence from Disk Images
Encrypted Volume Analysis
Advanced Artifact Recovery
Full-scale Incident Response Simulation
Multi-System Evidence Collection
File System, Logs, Memory & Disk Correlation
Building Complete Attack Timeline
Professional IR Report Writing
Stakeholder Communication & Briefings
Evidence Presentation & Court Testimony
Post-Incident Analysis & Lessons Learned