Digital Forensics: Zero to Professional
Investigate computers, phones, memory and networks like a professional: preserve evidence, recover deleted files, read Windows artefacts, analyse RAM, build timelines and write reports that stand up in court.
What you'll learn
- Run an investigation the professional way: identify, preserve, collect, examine, analyse and report
- Keep a chain of custody and prove evidence hasn't changed using hashes
- Create forensic images of drives and RAM with write protection
- Recover deleted files and explain how file systems (NTFS, FAT) store data
- Investigate a case in Autopsy and read Windows artefacts: registry, prefetch, event logs, shellbags, MFT
- Analyse emails, browser history and super-timelines to reconstruct what happened
- Analyse memory with Volatility 3 and triage Android and iPhone extractions
- Investigate network captures and recognise common attack traces
- Write a clear forensic report and explain how electronic evidence is admitted in court
Course content
Part 1. Start here: what digital forensics is6 lessons
- Digital forensics in under 5 minutes (EC-Council)by EC-Council4 min
- DFS101 1.1: Introduction to digital forensics (DFIRScience)by DFIRScience22 min
- DFS101 1.2: Introduction to cybercrime and networksby DFIRScience22 min
- DFS101 1.3: Cybersecurity and cybercrimeby DFIRScience23 min
- How this course works — and the rules
- Quiz: the basics
Part 2. The investigation process and the law9 lessons
- DFS101 4.1: Basics of cybercrime investigationby DFIRScience20 min
- DFS101 4.2: Digital investigation methodsby DFIRScience18 min
- DFS101 4.3: Electronic evidenceby DFIRScience10 min
- DFS101 5.1: What a digital investigation isby DFIRScience21 min
- DFS101 5.2: The scientific method in digital investigationsby DFIRScience20 min
- DFS101 5.3: Digital investigation procedureby DFIRScience20 min
- What chain of custody is and why it matters for digital evidenceby eyeWitness to Atrocities3 min
- Principles every examiner follows
- Quiz: process and principles
Part 3. How computers store data6 lessons
- DFS101 3.1: Introduction to computersby DFIRScience24 min
- DFS101 3.1: Introduction to computers, part IIby DFIRScience22 min
- DFS101 6.1: Data storageby DFIRScience11 min
- DFS101 6.2: Data structuresby DFIRScience9 min
- Anatomy of an NTFS file record (13Cubed)by 13Cubed12 min
- NTFS MFT and journal forensics with MFTECmd (13Cubed)by 13Cubed22 min
Part 4. Acquisition: forensic images, write blockers and hashes5 lessons
- DFS101 6.3: Data acquisitionby DFIRScience12 min
- Write blocker setup and forensic imaging walkthrough (DFIRScience)by DFIRScience16 min
- How to make a forensic image with FTK Imagerby DFIR Noob11 min
- What is hashing? MD5, SHA-1 and SHA-256 explainedby CyberSafetyCops12 min
- Practice: image a USB drive and prove it
Part 5. Recovering deleted data5 lessons
Part 6. Investigating a case in Autopsy6 lessons
- DFS101 8.1: Location and meaning of databy DFIRScience18 min
- Starting a new investigation case in Autopsy (DFIRScience)by DFIRScience39 min
- DFS101 8.3: Processing and analysing a disk image with Autopsyby DFIRScience39 min
- DFS101 8.4: Hash sets and hfind from the command lineby DFIRScience18 min
- Practice evidence: NIST CFReDS
- Practice: your first Autopsy case
Part 7. Windows forensics10 lessons
- Introduction to Windows forensics (13Cubed)by 13Cubed1h 5m
- Windows registry artefacts: a walkthrough (DFIRScience)by DFIRScience35 min
- Prefetch in 120 secondsby CyberFox2 min
- Shimcache in 120 secondsby CyberFox3 min
- ShellBag forensics: proving which folders were opened (13Cubed)by 13Cubed14 min
- Quick forensics of Windows event logs (John Hammond)by John Hammond10 min
- Windows SRUM forensics: app and network usage (13Cubed)by 13Cubed19 min
- Persistence mechanisms: how attackers survive reboots (13Cubed)by 13Cubed16 min
- Windows artefacts cheat sheet
- Quiz: Windows artefacts
Part 8. Email, browsers and timelines8 lessons
- Email header analysis and forensic investigation (13Cubed)by 13Cubed23 min
- Summarising web browsing activity (SANS DFIR Summit)by SANS Digital Forensics and Incident Response36 min
- Super-timelines with Plaso: Introby 13Cubed4 min
- Super-timelines with Plaso: Using log2timeline.pyby 13Cubed16 min
- Super-timelines with Plaso: Using psort.pyby 13Cubed8 min
- Super-timelines with Plaso: Reviewing Results in Timeline Explorerby 13Cubed9 min
- Super-timelines with Plaso: Recapby 13Cubed2 min
- Practice: trace a suspicious email
Part 9. Memory forensics14 lessons
- Introduction to memory forensics (13Cubed)by 13Cubed23 min
- DFS101 10.1: RAM acquisition and analysisby DFIRScience18 min
- DFS101 10.2: Capturing memory in Windows with FTK Imagerby DFIRScience10 min
- Volatility 3: Install Volatility 3 on Windowsby DFIRScience5 min
- Volatility 3: Listing installed pluginsby DFIRScience4 min
- Volatility 3: Get process list from RAM with windows.pslistby DFIRScience3 min
- Volatility 3: Find process handles with windows.handlesby DFIRScience5 min
- Volatility 3: Dump a specific file from RAm with windows.dumpfileby DFIRScience3 min
- Volatility 3: Find active network connections with windows.netstatby DFIRScience4 min
- Volatility 3: Analyze user actions with windows.registry.userassistby DFIRScience3 min
- Volatility 3: Analyze a specific Registry key from RAM with windows.registry.printkeyby DFIRScience3 min
- Volatility 3: Intro to Volatility 3 reviewby DFIRScience2 min
- Rapid Windows memory analysis with Volatility 3 (John Hammond)by John Hammond15 min
- Quiz: memory
Part 10. Mobile forensics: Android and iPhone6 lessons
- DFS101 11.1: Mobile device investigationsby DFIRScience22 min
- DFS101 11.2: Mobile device acquisitionby DFIRScience16 min
- Fast Android forensic triage with ALEAPP (DFIRScience)by DFIRScience3 min
- Fast iPhone forensic analysis with iLEAPP (DFIRScience)by DFIRScience4 min
- Introduction to iLEAPP (13Cubed)by 13Cubed15 min
- Handling phones properly
Part 11. Network forensics and attack traces5 lessons
Part 12. Reporting, court and international cases8 lessons
- DFS101 4.4: Documentation and reporting for digital investigationsby DFIRScience23 min
- How to testify as a digital forensics expertby Joseph H.Schuessler7 min
- How electronic evidence is tendered in Nigeria: section 84 of the Evidence Actby BAR TALK WITH OLA!10 min
- Extracting legally admissible electronic evidence (East Africa Law Society)by East Africa Law Society1h 59m
- DFS101 12.1: The international nature of cybercrimeby DFIRScience19 min
- DFS101 12.2: International cooperation todayby DFIRScience19 min
- Electronic evidence in African courts
- Quiz: reporting and the law
Part 13. Careers in digital forensics6 lessons
- Become a cyber forensic investigator: a beginner's roadmap (UnixGuy)by UnixGuy | Cyber Security16 min
- Life as a cyber forensic investigator, and which certifications matterby UnixGuy | Cyber Security13 min
- Digital forensics careers in South Africaby Lifereset with Boni6 min
- Digital forensics and cybersecurity in Nigeria with Dr Robinson Tombari Sibeby Dr. Maurice Dawson Jr.45 min
- DFS101 13.2: Keeping up to date with digital forensicsby DFIRScience35 min
- Roles, certifications and your portfolio
Part 14. Final project1 lesson
Capstone project: Capstone: a full investigation and court-ready report. You finish by building something real; a mentor reviews it before your certificate is issued.
About this course
When there's a fraud, a hack, a leak or a crime involving a phone or computer, digital forensic investigators find out what really happened — and prove it in a way a court will accept. It's one of the most respected careers in cybersecurity, needed by police, banks, telecoms, law firms, auditors and incident-response teams across Africa and the world. This course follows DFIRScience's complete university course DFS101 by Dr Joshua James, a professor and former investigator, with specialist lessons from 13Cubed (Windows, memory and timeline forensics), SANS DFIR, John Hammond and MyDFIR. You'll learn the investigation process and chain of custody, how data is stored, forensic imaging and hashing, recovering deleted files, Autopsy, Windows artefacts (registry, prefetch, event logs, shellbags, MFT), email and browser evidence, super-timelines, memory forensics with Volatility, Android and iPhone investigations, network forensics, and how electronic evidence is admitted in court — including section 84 of Nigeria's Evidence Act and East African practice. Every skill is practised on free tools and legal training evidence, and you finish with a full investigation and court-ready report. About 22 hours of video plus labs.
Learners also took
Free courses that go well with this one.
Cybersecurity Fundamentals
How attacks happen, how networks work, how to protect yourself — and how to start a security career.
Excel & Google Sheets Essentials
The spreadsheet skills every student, worker and business owner needs.
Cybersecurity Analyst: Zero to Job-Ready (SOC Analyst Path)
The intensive path into a cybersecurity job: security principles, networking, Linux, Python, phishing analysis, network monitoring with Wireshark and Snort, SIEM with Splunk, vulnerabilities, incident response — and a portfolio investigation.
Data Analysis: Excel, SQL & Power BI
Start a career in one of the most in-demand skills: turning data into decisions.