Digital Forensics
Investigate digital evidence from computers, networks, and mobile devices for incident response and legal proceedings.
10 Topics
Key concepts
3 Levels
Beginner to Advanced
3 Tools
Curated for this track
8 Questions
Test yourself
About this track
Reconstruct what happened, in a way that holds up.
Digital forensics is disciplined reconstruction. Given a disk image, a memory capture, or a pile of logs, the job is to establish a defensible timeline of what happened, when, and by whom — and to do it without contaminating the evidence.
This track covers the major evidence sources in turn: disk, memory, network, and mobile. Alongside the technical work it takes procedure seriously, because an analysis that cannot survive scrutiny of its chain of custody is worth very little in the contexts where forensics matters most.
It pairs directly with incident response: in practice the same people often do both, under time pressure.
Key topics
10 topics grouped into three modules, in the order you should meet them.
- 01
Evidence handling
4 topics- 1.
Disk Forensics
Imaging, hashing, and carving artefacts out of file system structures.
- 2.
Memory Forensics
Volatile evidence — running processes, injected code, and keys that exist nowhere on disk.
- 3.
Network Forensics
Reconstructing sessions and transfers from captured traffic.
- 4.
Mobile Forensics
Acquisition and analysis on locked, encrypted, and cloud-backed devices.
- 1.
- 02
Analysis by source
4 topics- 5.
Log Analysis
Correlating across sources where each one only tells part of the story.
- 6.
Evidence Collection
Order of volatility, write blockers, and the decisions made in the first ten minutes.
- 7.
Chain of Custody
The documentation that makes an analysis defensible rather than merely correct.
- 8.
Timeline Analysis
Fusing timestamps from many sources into one coherent narrative.
- 5.
- 03
Timeline & response
2 topics- 9.
File System Analysis
NTFS, ext4, and APFS internals — where deleted data actually lingers.
- 10.
Incident Response
The wider process forensics feeds: contain, eradicate, recover, learn.
- 9.
What you'll be able to do
- Acquire disk and memory images without altering the source
- Reconstruct a defensible timeline from multiple independent evidence sources
- Recover deleted and partially overwritten artefacts from a file system
- Maintain chain of custody documentation that survives review