This module introduces learners to the foundational concepts of digital forensics and its critical role in cybersecurity investigations. It explores how digital forensics supports incident response, evidence collection, and legal proceedings, while also addressing ethical and operational boundaries.

In this module, you’ll learn how digital evidence is acquired and preserved in a way that keeps it reliable, defensible, and legally admissible. We’ll walk through the full acquisition process—from understanding image formats and handling devices safely to using tools like FTK Imager and dd for accurate disk imaging. You’ll also explore hashing, write blockers, and chain of custody procedures that ensure evidence remains untampered and trustworthy. By the end, you’ll understand how proper acquisition and preservation form the foundation of every successful digital investigation.

In this module, you’ll learn how to examine digital media and uncover the traces users and systems leave behind. We’ll break down the essentials of file systems, metadata, and deleted file recovery so you can start identifying meaningful artifacts in real forensic cases. You’ll explore how user activity, system logs, and application traces come together to form a timeline of events that tells the story of what happened on a machine. By the end, you’ll be able to extract key evidence, analyze it with industry tools, and interpret patterns that support a clear forensic narrative.

In this module, you’ll learn how to turn your forensic analysis into a clear, defensible report that can stand up to scrutiny in legal, corporate, or investigative environments. We’ll walk through the essential sections of a professional forensic report, explore how to document evidence accurately, and practice writing in a way that is objective, concise, and easy for non-technical audiences to understand. You’ll also learn how to maintain chain of custody records, prepare screenshots and supporting visuals, and avoid common reporting mistakes that can weaken a case. By the end, you’ll feel confident finalizing and presenting a forensic report that communicates your findings with clarity, credibility, and professionalism.

In this wrap-up module, you’ll apply your full set of digital forensics skills by analyzing a provided disk image in Autopsy. You’ll extract artifacts, interpret activity, and create a clear forensic report that demonstrates your ability to handle a real investigation from start to finish.