Computer Forensics

Collecting and Analyzing Digital Evidence for Cybercrime

Information Security Basics 4.3(52)3h 5m19 lectures2 sections

What you'll learn

Understand the basics of digital forensics
Distinguish between digital forensics and digital investigation
Understand the digital investigation methodology
Get to know the types of digital forensics
Understand network forensics
Handle and acquire digital evidence
Use digital forensics tools
Analyze malware and rootkits
Understand mobile device forensics

About this course

This course explains computer forensics, meaning digital forensics and digital investigation of cybercrime. It starts with an introduction to computer forensics and its basic concepts, then the difference between digital forensics and digital investigation, the methodology in two parts, and the types of digital forensics. After that you learn network forensics in two parts, computing devices and the Internet of Things, acquisition and authentication, digital forensics tools, and the steps of forensic analysis. Then you move to the Microsoft Windows operating system and performing live acquisitions, malware analysis in two parts, rootkit techniques, and mobile forensics, with a downloadable workbook. It suits people interested in cybersecurity, IT managers and anyone who wants to understand how digital evidence is examined, and it helps to know computer basics. By the end, you will understand the digital investigation methodology and how to handle and analyze evidence.

Expected outcomes

Conduct digital investigations using advanced methodologies and tools.
Analyze malware and uncover hidden roots.
Apply forensic analysis steps for devices and networks.
Handle digital evidence accurately and professionally.

Learner reviews

These reviews are from learners who bought the content and completed at least 50% of it — there are no reviews from anyone who hasn't gone through the material.

4.3

★★★★☆

52 reviews

5★

4★

3★

2★

1★

Course content

Computer Forensics

18 lectures

Introduction to Computer ForensicsIntroduces computer forensics: its role after a company is breached, and its steps from legal authority, chain of custody, hashing and backup to analysis, drawing conclusions, and giving expert testimony in court.6:41
Fundamental ConceptsExplains core digital forensics concepts: the digital footprint, its goals, types of cybercrime, what counts as digital evidence, and the conditions for court acceptance such as being original, complete, and clear.10:02
Digital Forensics and Digital InvestigationExplains digital investigation and the sources of digital evidence in any device with storage, forensic capabilities such as recovering deleted files, who uses it, the rule of never altering original data, and key places to look.7:27
Methodology (Part One)Explains the first part of the computer forensics methodology for a cyber crime: the investigator's steps, mathematical verification of storage media, documenting dates and files, and the skills a forensic investigator needs.8:37
Methodology (Part Two)Explains the second part of the methodology and its five steps: identification, preservation in a safe place, analysis, documentation, and presenting findings in plain language the court can understand without obscure jargon.5:15
Types of Digital ForensicsExplains the types of digital forensics by data source, such as hard disks, databases, malware analysis, and mobile phones, along with its challenges and its benefits for courts and companies.13:27
Digital Forensics and Networks (Part One)Explains networking basics for digital forensics: what a network, protocol, and router are, network types such as LAN, WAN, VPN, intranet, and the Internet, and why protecting privacy matters.10:19
Digital Forensics and Networks (Part Two)Explains common network vulnerabilities and how attackers exploit them, such as malware and social engineering, and the defenses: physically securing servers, using genuine software, and configuring the firewall and operating system.7:06
Digital Forensics Devices and Computing and IOTsExplains cloud computing and the Internet of Things and their impact on digital investigation, their benefits like speed and flexibility, the difficulty of collecting evidence online, and the OWASP project on IoT vulnerabilities.9:28
Acquisition and AuthenticationExplains acquiring and authenticating digital evidence without altering it, forensic image file formats, static and live acquisition with their four methods, and verifying evidence integrity with hash values.11:25
Digital Forensics ToolsPresents digital forensics tools on Windows and Linux, examples of verifying evidence integrity with hashes such as MD5 and SHA1, the dd command for disk copies, and well-known acquisition tools such as DEFT Linux.11:35
Steps of Forensic AnalysisExplains the four sequential stages of forensic analysis: seizing the device, acquiring data, analysis, and reporting, with tool validation by comparing hashes and the option of a second investigator's review.14:28
Microsoft Windows Operating SystemA hands-on look at Windows forensics: where evidence lives in the system, memory files such as the page file and swap file, disk management, user folders, and how to reveal protected system files.19:10
Conducting Live Acquisition OperationsExplains live evidence acquisition from a network-connected machine that was compromised: prioritizing volatile RAM data, logging every action, collecting through another machine, and using packet sniffers.10:44
Malware (Part One) Forensics MalwareExplains malware, its ten types, how it spreads and what it aims for, signs of infection, the knowledge needed to analyze it such as assembly language and file formats, and tools like IDA Pro and Process Explorer.13:14
Malware (Part Two) Forensics MalwareExplains the two types of malware analysis: static analysis, which inspects a file without running it, and dynamic analysis, which runs it in a virtual machine to study its effect on the system, with example tools.7:34
Rootkit Techniques Toolkit TechniquesExplains rootkits, how they hide, disable protection software, and take control of a device, symptoms of infection, their types such as kernel mode, user mode, bootloader, and firmware, and why they are hard to remove.11:47
Mobile ForensicsExplains mobile forensics on Android and iOS, how they differ in security, the risks of rooting a device, how a phone appears when connected to a computer, and where photos and files are stored.7:04