Course Outline:

Module 1: Introduction to Computer Forensics

• Topics Covered:
  • Fundamentals of Computer Forensics
  • Types of Cybercrimes and Digital Evidence
  • Forensic Investigation Process and Methodology
  • Legal Considerations in Forensics
  • Chain of Custody and Evidence Handling

• Hands-On Labs:
  • Setting up a forensic workstation
  • Practicing chain of custody and evidence handling

Module 2: Evidence Acquisition and Preservation

• Topics Covered:
  • Importance of Evidence Preservation
  • Imaging Techniques and Tools (e.g., FTK Imager, EnCase)
  • Creating Forensic Copies (Bit-by-Bit Imaging)
  • Evidence Integrity and Verification (Hashing)
  • Live vs. Dead Acquisition

• Hands-On Labs:
  • Creating forensic images of hard drives
  • Verifying images with hashing algorithms
  • Live data acquisition from a running system

Module 3: File Systems and Data Recovery

• Topics Covered:
  • Overview of File Systems (FAT, NTFS, EXT, HFS+)
  • Understanding File Structures and Metadata
  • Data Recovery Techniques
  • Deleted File Recovery and Carving
  • Hidden and Encrypted Data

• Hands-On Labs:
  • Analyzing file structures in NTFS and EXT
  • Recovering deleted files using forensic tools
  • Data carving techniques to extract hidden files

Module 4: Windows Forensics

• Topics Covered:
  • Registry Analysis and Artifact Extraction
  • Windows Event Logs and System Files
  • Forensic Analysis of Windows Artifacts (prefetch, recycle bin, etc.)
  • Analyzing User Activity (recent files, browser history)
  • Memory Forensics in Windows

• Hands-On Labs:
  • Registry analysis for user activity tracking
  • Analyzing Windows event logs
  • Memory analysis to detect malicious activity

Module 5: Linux and MacOS Forensics

• Topics Covered:
  • Basics of Linux and MacOS File Systems
  • Log File Analysis in Linux and MacOS
  • User and System Activity Tracing
  • Analyzing Linux Partitions and Artifacts
  • Data Recovery and Forensics Tools for Linux and MacOS

• Hands-On Labs:
  • Analyzing log files and shell history in Linux
  • Investigating user activities and file access
  • Data recovery from Linux and MacOS systems

Module 6: Network Forensics

• Topics Covered:
  • Fundamentals of Network Forensics
  • Capturing and Analyzing Network Traffic
  • Intrusion Detection and Incident Response
  • Tools for Network Forensics (Wireshark, Tcpdump)
  • Analyzing Packet Captures (PCAP files) for Forensics

• Hands-On Labs:
  • Capturing network traffic with Wireshark
  • Analyzing packet captures for signs of intrusion
  • Identifying malicious activities in PCAP files

Module 7: Mobile Device Forensics

• Topics Covered:
  • Overview of Mobile Operating Systems (iOS, Android)
  • Mobile Forensics Tools and Techniques
  • Data Acquisition from Mobile Devices
  • Analysis of Call Logs, Messages, and App Data
  • Challenges in Mobile Forensics (encryption, cloud backups)

• Hands-On Labs:
  • Acquiring data from mobile devices
  • Analyzing call logs and messages on Android
  • Extracting app data for forensic analysis

Module 8: Forensic Reporting and Documentation

• Topics Covered:
  • Documenting Findings and Analysis
  • Writing Forensic Reports for Legal Proceedings
  • Presentation of Forensic Evidence
  • Best Practices in Reporting and Evidence Storage
  • Testifying as a Forensic Expert

• Hands-On Labs:
  • Preparing forensic reports using templates
  • Documenting findings with screenshots and summaries
  • Role-playing expert witness testimony for court preparation

Structured Labs and Case Studies

• Structured Labs:
  • Lab: Imaging and verifying a hard drive
  • Lab: File recovery and data carving
  • Lab: Registry analysis and event log analysis
  • Lab: Network traffic capture and analysis
  • Lab: Mobile device data acquisition
  • Lab: Forensic report generation

• Case Studies:
  • Real-world forensic investigation scenarios for hands-on practice
  • Analyzing and reporting on simulated cyber incidents

Training material provided: Yes (Digital format)