Free through lesson 3

Introduction to Digital Forensics

Evidence preservation and hashing, disk and memory acquisition, file systems and timelines, Windows and Linux artefacts, network and log analysis, and the report. In 30 lessons you learn to collect evidence without altering it and reconstruct what happened.

Start from lesson 1 Unlock every course

Curriculum

The 30 lessons are grouped into six chapters. Working through from chapter 1 is recommended, but you can also dip into the parts you need. * Standard-library Python runs right in the browser. All commands and logs come from fictional hosts.

Chapter 1 — Forensics basics (lessons 1–5)

The aims of forensics and the principles, hashing and custody that keep evidence intact.

What Is Digital Forensics?

The big picture of reconstructing what happened from evidence. The four phases of collection, examination, analysis and reporting, and how legal and internal investigations differ.

Free

The Order of Volatility

RFC 3227's rule of collecting the most volatile evidence first. Why memory comes first, how collecting changes evidence, and handling power and time.

Free

Principles of Evidence Preservation

Three principles: do not alter the original, work on copies, document everything. Write protection, making working copies, and what not to do.

Free

Proving Integrity with Hashes

Taking a SHA-256 fingerprint of images and files to show they are unchanged between acquisition and analysis. Where MD5 and SHA-1 stand, and what a hash does not prove.

Chain of Custody

Recording, without gaps, who held the evidence, when, and how it was handed over. Custody forms, labels and seals, storage, and handover accidents.

Chapter 2 — Collection (lessons 6–10)

Collecting evidence from disks, memory, logs and the cloud, and documenting how you did it.

Deciding What to Collect

You cannot collect everything, so you choose between triage and full collection. Typical triage artefacts and how to set priorities.

Acquiring a Disk Image

Copying a disk bit by bit. Write blockers, the ideas behind dd, dc3dd and the E01 format (ewfacquire), and verifying hashes after acquisition.

Acquiring Memory

Why and with what tools you capture memory, which vanishes at power-off, from a running system. The risks of capture itself, virtual machines, and the record afterwards.

Logs and Cloud Evidence

Logs disappear once their retention period passes. Preserving server logs, pulling cloud audit logs through provider APIs, extending retention, and shared responsibility.

Writing Collection Notes

What goes into collection notes, how to write times, how to keep the commands you ran, and recording the unexpected. Notes you cannot recreate later, written on the spot.

Chapter 3 — File system analysis (lessons 11–15)

Reading events from the file system with timestamps, deleted files and timelines.

File system basics: the MFT and inodes

A file has three layers: name, metadata and content. Reading NTFS MFT records and ext4 inodes layer by layer with The Sleuth Kit.

Reading timestamps (MACB)

What the four times M, A, C and B mean and where they mislead. Normalising time zones, and spotting altered timestamps as anomalies.

Deleted files and carving

What deletion really removes and what it leaves. Unallocated space and slack, and the idea and limits of carving files out by their signatures.

Building a timeline

Building a file system timeline with fls and mactime. The body file format, and super timelines that merge many artefacts with Plaso.

Checking file types and contents

Identifying file types by magic numbers rather than extensions. Sorting files against known hash sets such as NSRL, and inspecting content safely without running it.

Chapter 4 — Artefacts by platform (lessons 16–20)

The traces left on Windows, Linux, browsers and mail, and in memory.

Windows artefacts 1: the registry and execution traces

Where the registry hives live and which keys record user activity. What Prefetch, ShimCache and Amcache show, and what they do not.

Windows artefacts 2: event logs, tasks and services

Where evtx files live and how to export them, and the event IDs to check first. Where scheduled tasks and services leave evidence of persistence.

Linux artefacts

Mounting the image read-only and gathering traces from authentication logs, shell history, cron, systemd units and temporary directories.

Browser and email artefacts

Browser history is an SQLite database. Differences in time formats, traces of downloads (Zone.Identifier), and reading a message's route from its email headers.

Getting started with memory analysis

Information that exists only in memory, and the basic Volatility 3 plugins. Reading processes, command lines and network connections, then cross-checking with disk evidence.

Chapter 5 — Network and log analysis (lessons 21–25)

Following activity by correlating packets, flow summaries, and web and authentication logs.

Reading packet captures

What a pcap does and does not contain. Capture filters versus display filters, common Wireshark display filters, and narrowing down with tshark.

Summarising network traffic

Summarise the whole before reading packets one by one. Find conversations, top talkers and regularly spaced connections from flow records.

Tracing an intrusion through web server logs

What each field of an access log means, and how to rebuild the sequence from request order, status codes and User-Agent. Also what the log does not record.

Following activity through authentication logs

Windows events 4624 / 4625, logon types, and linking a session by Logon ID. Following who logged in from where with Linux sshd logs and last.

Correlating multiple sources of evidence

Align the clocks and link separate records through IPs, users, hosts and hashes. How to handle contradictions and assign confidence levels.

Chapter 6 — Reporting (lessons 26–30)

Writing findings that separate fact from inference, and assembling the report. The course ends with a small case from start to finish.

Writing findings

Write findings separated into fact, inference and opinion. Cite evidence numbers, convey certainty through wording, and state correctly what was not found.

Communicating with tables and diagrams

Which columns a timeline table needs and how to order it, showing UTC and Japan time side by side. Diagrams of traffic flow draw only facts as lines.

Structuring the report

The report skeleton: summary, scope and limitations, method, findings, recommendations, appendices. Each reader reads a different part; versions and distribution are controlled.

Legal proceedings and evidence

The basics of how evidence is treated in Japanese criminal and civil proceedings. Points to watch when working with lawyers and the police, and preparing to explain your work as an investigator.

Wrap-up: a small case from start to finish

Follow a fictional online-shop incident from the first alert through preservation, collection, analysis, correlation and reporting, and see where each lesson of the course comes in.

Once you have finished all 30 lessons, move on to the System Hardening course. See the order of courses on the security track page. Membership unlocks every course.