Digital Forensics Roadmap

Investigate digital evidence from computers, networks, and mobile devices for incident response and legal proceedings.

3 Levels

Beginner to Advanced

22 Topics

Across all levels

9 Resources

Labs, courses, books

~6 months

Estimated total

Overall progress0 / 22 topics

Checkboxes are saved in this browser only. Nothing is uploaded.

Beginner

4 – 8 weeks

0/7

Topics

Forensics methodology
Evidence handling
Chain of custody
Disk imaging
File system basics (NTFS, ext4)
Basic Autopsy usage
Log analysis fundamentals

Resources

TryHackMe Digital ForensicsPath
Autopsy trainingTool
CHFI study materialCourse

Intermediate

8 – 16 weeks

0/7

Topics

Memory forensics with Volatility
Windows artifact analysis
Registry forensics
Browser forensics
Email forensics
Timeline analysis
Network forensics

Resources

CyberDefenders challengesLab
SANS DFIR PosterReference
13Cubed YouTubeVideo

Advanced

12 – 24 weeks

0/8

Topics

Advanced memory analysis
Mobile forensics
Cloud forensics
Anti-forensics detection
Malware forensics
Incident response
Expert witness testimony
Forensic tool development

Resources

SANS FOR508Course
GCFA certificationCertification
DFIR Summit presentationsResearch

Tools you'll use

See all for this track

VolatilityDigital Forensics

SplunkBlue Team

AutopsyDigital Forensics

Ready to go deeper?

Read the full Digital Forensics track, or test yourself with the quiz.

Open track Take quiz All roadmaps

CyberForgeSecurity platform

The reference platform for security professionals, students, and enthusiasts. Learn, practice, and grow — all for free.

Free & open source

Platform

Tracks
Tools
Cheat Sheets
Labs & CTFs
News

Learning

Roadmaps
Resources
Glossary
CTF Writeups
Practice Quiz
Certifications

Contact

hello@cyberforge.dev

Bug reports, suggestions and contributions are always welcome.

Developed bymo2ziiiy