About the Course

Digital Forensics is a foundational course designed to introduce learners to the systematic process of examining digital evidence and investigating information stored across computers and digital storage systems. The course develops an understanding of how digital forensic investigations are conducted, beginning with the fundamentals of digital forensics, its uses, the skills required of forensic experts, Locard’s Exchange Principle, and important technical concepts related to digital evidence.

The course provides a strong foundation in storage and file systems, covering storage types, hard disk structures, file system concepts, allocated and unallocated space, slack and free space, and the distinction between deleted and wiped data. These concepts help learners understand where digital evidence may exist and how information can be identified during a forensic examination.

Learners will then explore digital evidence acquisition and forensic imaging, including identifying disk regions that may contain evidence, understanding acquisition methods and their limitations, preparing forensic images, and handling evidence from different platforms. Particular emphasis is placed on chain of custody, evidence handling, and evidence integrity, ensuring that digital evidence remains reliable throughout the investigation process.

The course also introduces the digital forensics analysis process and registry forensics. Learners will examine digital evidence, determine the scope of analysis, work with logical and deleted data, and understand the acquisition-to-reporting cycle. Registry forensics covers registry file acquisition, registry structures, analysis using AccessData FTK Imager, and common issues encountered during registry analysis.

The final part of the course focuses on Windows artifacts and USB device forensics. Learners will study Windows registry structures, registry and supportive hives, Windows system artifacts, USB flash-drive storage, and forensic techniques for examining and recovering information from broken, destroyed, or monolithic USB flash drives.

By the end of the course, learners will have a clear understanding of the digital forensic investigation workflow, from identifying potential evidence and acquiring forensic images to analyzing digital artifacts and maintaining evidence integrity. The course provides a solid foundation for learners interested in Digital Forensics, Cybercrime Investigation, Incident Investigation, and Forensic Analysis.