By the end of this course, you will be able to
Understand the fundamentals, stages, and types of digital forensics.
Apply Chain of Custody principles to preserve the integrity of digital evidence.
Analyze network traffic using Wireshark, NetworkMiner, and TcpDump.
Detect suspicious activity, lateral movement, attacks, and malware through network analysis.
Create forensic disk images using FTK Imager and DD.
Course Details
- 4h 35min / 28 lessons
- Course completion certificate
Course Content
Course Introduction
Introduction to Disk Forensics
Course Introduction
Introduction to Digital Forensics
Types of Digital Forensics
Digital Forensics Methodology
Chain of Custody
Introduction to Network Forensics
Types of Network Investigations
Capturing Network Traffic using Wireshark
Wireshark Filtering
Detecting Lateral Movement
Malware Investigation using Wireshark
Network Analysis using NetworkMiner
Packet Capture using TcpDump
TcpDump Filtering and Attack Detection
Introduction to Disk Forensics
MBR vs GPT
Windows File System
Linux File System Part 1
Linux File System Part 2
macOS File System
Creating Disk Images using FTK Imager
Creating Disk Images using DD
Recovering Deleted Images using PhotoRec
Recovering Deleted Files using Autopsy
Introduction to Memory Forensics
Memory Capture in Windows
Memory Capture in Linux
Memory Analysis using Volatility
About this course
This course is designed to help you understand the fundamentals of digital forensics and analyze digital evidence through hands-on practice. You’ll learn how to preserve evidence, analyze networks using Wireshark, NetworkMiner, and TcpDump, examine disks and file systems on Windows, Linux, and macOS using FTK Imager and DD, recover deleted files using Autopsy and PhotoRec, and analyze memory using Volatility.
Course requirements and prerequisites
Basic knowledge of operating systems, networking, and cybersecurity concepts is recommended to get the most out of this course.
Instructor
Abdalla Hijjawe
Cybersecurity Analyst
98 Learners
2 Course