MODULE 1. FOUNDATIONS OF DIGITAL FORENSICS AND EVIDENCE GOVERNANCE
In this module, you will learn the core foundational principles of digital forensics, including accuracy, integrity, and repeatability. You will understand how to establish and maintain a proper chain of custody, ensuring the admissibility of the evidence in court. The module also introduces key legal frameworks, lab readiness standards, and the importance of a strong documentation culture in supporting credible, defensible forensic investigations.
MODULE 2. STORAGE MEDIA, FILE SYSTEMS, AND DATA STRUCTURES
This module covers how different storage media and file systems behave from a forensic perspective. You will learn about HDD and SSD characteristics, understand TRIM and wear-levelling implications, and analyze FAT, NTFS, exFAT, EXT, and XFS artefacts. The module also explores sector-level examination and file metadata lifecycles, helping you gain skills to interpret recovered data accurately and assess digital evidence deeply and accurately.
MODULE 3. WINDOWS FORENSICS: SYSTEM, USER, AND APPLICATION ARTEFACTS
In this module, you will learn how to analyze key Windows system, user, and application artefacts that reveal activity patterns during forensic investigations. You will explore registry internals and hive evaluation, event logs, audit trails, and application usage traces, along with user account behaviors. The module also covers Shellbags, Jump Lists, SRUM (System Resource Usage Monitor), Prefetch, Amcache, and techniques for recovering deleted artefacts, enabling you to reconstruct user actions with high accuracy.
MODULE 4. LINUX FORENSICS AND BEHAVIOURAL ARTEFACT MAPPING
This module teaches you how to investigate Linux systems by analyzing behavioral artefacts and system activity patterns. You will learn about syslog entries, bash history interpretation, and traces left by scheduled cron jobs. The module also covers permission and group behavior analysis, along with service-specific artefacts, helping you understand how to reconstruct user actions, identify anomalies, and understand incident timelines within Linux environments.
MODULE 5. MEMORY FORENSICS AND VOLATILE DATA ANALYSIS
In this module, you will learn how to acquire, analyze, and interpret volatile memory to uncover critical forensic evidence. You will understand RAM acquisition methods, process and thread mapping, and the role of kernel structures and hooks. The module also focuses on detecting stealthy malware, using volatility frameworks, and extracting timeline elements from memory, enabling thorough investigation of live system activity.
MODULE 6. NETWORK FORENSICS AND TRAFFIC RECONSTRUCTION
This module focuses on how to analyze network activity to find evidence of intrusion or malicious behavior. You will learn packet-level dissection, reconstruct sessions and flows, and identify suspicious outbound patterns, including C2 (Command and Control System) communication and beaconing patterns. Additionally, the module teaches you encrypted traffic profiling and proper preservation of network evidence to help you gain skills to trace attacks and build accurate forensic timelines.
MODULE 7. EMAIL AND COMMUNICATION FORENSICS
In this module, you will learn how to investigate email communications by analyzing headers, metadata, and mailbox artefacts. You will understand spoofing techniques and how to detect them, along with parsing PST (Personal Storage Table) and OST (Offline Storage Table) files for deeper evidence extraction. The module also introduces a model for investigating enterprise email so that you can learn how to trace message origins and identify manipulation.
MODULE 8. BROWSER AND ONLINE ACTIVITY RECONSTRUCTION
In this module, you will gain an understanding of how to reconstruct online activity by examining browser artefacts such as cache, cookies, and history. You will learn ways to extract and analyze SQLite databases, interpret autofill data, and understand the myths related to private browsing modes. The module also covers download logs and related artefacts, enabling you to trace user behavior, identify browsing patterns, and find evidence of online interactions.
MODULE 9. ANDROID FORENSICS AND APP DATA INTERPRETATION
This module explores how to investigate Android devices including app data by understanding partition structures and choosing between logical and physical acquisition methods. You will learn how to analyze app sandbox environments, evaluate token and credential storage, and recover deleted artefacts. Finally, you will gain insights into the concept of secure folders and encrypted zones, which will enable you to interpret mobile data accurately and find crucial evidence within Android ecosystems.
MODULE 10. IOS FORENSICS AND APPLE ECOSYSTEM ANALYSIS
In this module, you will learn how to perform forensic analysis within the iOS and broader Apple ecosystem. You will learn methods to dissect iTunes backups, identify iCloud-based forensic points, and understand keychain extraction logic. The module also covers app container behavior, system logs, crash data, and Apple’s security models and restrictions. After this module, you will gain the ability to extract, interpret, and preserve evidence unique to iOS devices effectively.
MODULE 11. CLOUD FORENSICS AND DISTRIBUTED EVIDENCE HANDLING
This module focuses on how to investigate incidents within cloud environments and manage distributed evidence. You will study cloud logging architectures, understand evidence differences across SaaS, IaaS, and PaaS models, and learn methods for virtual instance acquisition. The module also covers cloud storage metadata interpretation and multi-account correlation, which are required to conduct deep and legally acceptable cloud forensic investigations.
MODULE 12. MALWARE FORENSICS AND BEHAVIOUR PROFILING
In this module, you will learn how to analyze malware samples using both static and dynamic forensic techniques. You will gain understanding of static triage, use sandboxing for behavioral observation, and detect persistence mechanisms. The module also covers malware family classification and artefact signature identification, equipping you with knowledge to identify profile threats, trace their behavior, and discover indicators essential for incident response and remediation.
MODULE 13. RANSOMWARE INVESTIGATION AND DATA RECONSTRUCTION
This module covers the concept of ransomware incidents’ investigation and data reconstruction by identifying encryption patterns, attack indicators, and pathways used for lateral movement. You will learn how to analyze shadow copies, assess recovery possibilities, and apply partial data restoration techniques. The module also teaches you negotiation artefacts that will help you to reconstruct attack timelines, understand adversary behavior, and support informed recovery decisions during ransomware events.
MODULE 14. LOG FORENSICS AND EVENT CORRELATION
In this module, you will learn how to analyze logs from hosts and networks to find meaningful forensic patterns. You will learn how to conduct SIEM-based investigations, correlate events across multiple sources, and identify signs of manipulated or fabricated logs. The module also teaches large-scale timeline creation, enabling you to reconstruct complex incidents and connect dispersed evidence into a clear investigative narrative.
MODULE 15. MOBILE NETWORK AND COMMUNICATION FORENSICS
This module explores ways to analyze mobile network communications to extract investigative insights. You will study call detail records, metadata patterns, and artefacts from SMS and instant messaging platforms. The module also covers interpreting location data trails and examining cloud-synced mobile logs, which will help you to reconstruct communication behavior and correlate mobile activity with broader forensic evidence.
MODULE 16. IOT AND EMBEDDED DEVICE FORENSICS
In this module, you will learn how to investigate IoT and embedded devices by extracting and analyzing firmware, accessing hardware interfaces like UART (Universal Asynchronous Receiver/Transmitter) and JTAG (Joint Test Action Group), and examining artefacts from smart home systems. You will also gain understanding of how to interpret data from wearables and study network behavior unique to IoT environments.
MODULE 17. FORENSIC REPORTING, DOCUMENTATION, AND EXPERT PRESENTATION
This module introduces you to the essential skills required for preparing clear, defensible, and professionally structured forensic reports. It covers how to organize complex findings logically, techniques for visualizing timelines, and digital artefacts to make technical evidence easy to understand for non-technical audiences. You will also learn how to develop courtroom-ready documentation that adheres to legal requirements, and finally, you will gain exposure to effective expert witness communication to present evidence confidently and respond to challenging questions professionally during testimony.
