Month 9 – Digital Forensics

 

Month 9 – Digital Forensics

Note: This module teaches students how to investigate cyber incidents by collecting, preserving, analyzing, and reporting digital evidence. All investigations should be performed only on systems you own or have permission to examine.

TopicWhat I Will DiscussToolWhat We Use the Tool ForPracticalTheory AssessmentPractical Assessment
Introduction to Digital ForensicsWhat digital forensics is, importance, investigation process, types of digital evidence.AutopsyTo investigate digital evidence from computers and storage devices.Open a sample forensic image in Autopsy.Define digital forensics and explain its importance.Open and explore a forensic image successfully.
Digital EvidenceTypes of digital evidence, evidence collection, evidence preservation.FTK ImagerTo safely collect digital evidence without modifying it.Create a forensic image of a USB drive or sample disk.Explain digital evidence and its importance.Acquire a forensic image successfully.
Chain of CustodyDocumentation, handling evidence, maintaining integrity, legal considerations.Microsoft WordTo document how evidence is collected, stored, and transferred.Complete a chain of custody form for a sample case.Explain the purpose of chain of custody.Correctly complete a chain of custody document.
Disk ForensicsHard disks, partitions, deleted files, file systems, metadata.AutopsyTo analyze hard drives and recover information.Analyze a sample disk image.Explain disk forensics concepts.Identify deleted files from a disk image.
File RecoveryDeleted files, recycle bin, recovery techniques, limitations.RecuvaTo recover deleted files from storage devices.Recover deleted files from a practice USB drive.Explain file recovery methods.Recover deleted files successfully.
Memory ForensicsRAM, running processes, malware in memory, volatile evidence.VolatilityTo analyze memory dumps for running processes and suspicious activity.Analyze a sample memory dump.Explain why memory forensics is important.Identify running processes from a memory image.
Browser ForensicsBrowser history, downloads, cookies, cache, saved passwords.BrowserHistoryViewTo analyze browser activity during investigations.Review browser history from a practice profile.Explain browser artifacts used in investigations.Extract browser history and explain findings.
Mobile Device ForensicsAndroid, iPhone basics, mobile evidence, app artifacts.AutopsyTo examine mobile backups and digital artifacts.Analyze a sample mobile backup.Explain the importance of mobile forensics.Identify evidence from a mobile backup.
Forensic ReportingReport writing, evidence presentation, documentation standards.Microsoft WordTo prepare professional forensic investigation reports.Write a forensic investigation report.Explain the components of a forensic report.Produce a complete forensic report.
Forensic Investigation ProcessPlanning, acquisition, examination, analysis, reporting, review.Autopsy & FTK ImagerTo perform a complete forensic investigation.Investigate a complete sample case from start to finish.Describe each phase of a forensic investigation.Complete a full forensic investigation and present the results.

End-of-Month Project

Project Title

Digital Forensics Investigation

Objectives

  • Collect digital evidence.

  • Preserve evidence integrity.

  • Recover deleted files.

  • Analyze browser activity.

  • Investigate a sample disk image.

  • Produce a professional forensic investigation report.

Tools

  • Autopsy

  • FTK Imager

  • Recuva

  • Volatility

  • BrowserHistoryView

  • Microsoft Word

Real-Life Projects

Project 1 – USB Drive Investigation

  • Create a forensic image of your own USB drive.

  • Recover deleted files (if any).

  • Document recovered evidence.

  • Produce an investigation report.

Project 2 – Browser Activity Review

Using your own computer or one you have permission to examine:

  • Review browser history.

  • Review downloads.

  • Review cookies.

  • Identify browsing patterns.

  • Produce a browser activity report.

End-of-Month Assessment

Theory Assessment (30%)

  • 20 Multiple Choice Questions

  • 10 Short Answer Questions

  • Digital evidence case studies

  • Forensic investigation scenarios

Practical Assessment (40%)

Students must:

  • Create a forensic image using FTK Imager.

  • Open and analyze a disk image in Autopsy.

  • Recover deleted files using Recuva.

  • Analyze a memory image using Volatility.

  • Review browser history.

  • Complete a chain of custody form.

  • Produce a professional forensic investigation report.

Project Assessment (20%)

Students will be assessed on:

  • Evidence collection procedure

  • Accuracy of forensic analysis

  • Recovery of deleted files

  • Quality of documentation

  • Professional presentation of findings

Class Participation (10%)

  • Attendance

  • Lab participation

  • Homework

  • Group discussions

  • Practical demonstrations

  • Case study presentation

Comments

Post a Comment

Popular posts from this blog

Nobigdeal Academy Cybersecurity Diploma Programme (12 Months)

Image
Cybersecurity Diploma Programme (12 Months) This programme is divided into four professional learning tracks. Each track lasts three months and builds on the knowledge and skills gained in the previous level. Students begin with the fundamentals of cybersecurity and gradually progress to advanced topics such as cloud security, security operations, digital forensics, and automation. Level 1: Cyber Defender (Foundation) Duration: 3 Months The Cyber Defender track is the foundation of the programme. It is designed for beginners who want to understand how computers, networks, and cybersecurity work. Students will learn how to recognize cyber threats, protect devices, and apply basic security measures to personal and business environments. During this level, students will study: Cybersecurity & Computer Fundamentals Networking Fundamentals Cyber Threats & Security Awareness Students will gain practical skills in: Computer security fundamentals Windows and Linux basics Networking ...
Read more

Month 8 – Security Operations Center (SOC) & Incident Response (Blue Team)

  Month 8 – Security Operations Center (SOC) & Incident Response (Blue Team) Note: This month focuses on defending systems , detecting suspicious activity, and responding to cybersecurity incidents. Topic What I Will Discuss Tool What We Use the Tool For Practical Theory Assessment Practical Assessment Introduction to SOC (Security Operations Center) What a SOC is, SOC roles, Tier 1–3 analysts, how a SOC operates. Microsoft Sentinel (Lab) To monitor and investigate security events from different systems. Explore the Microsoft Sentinel dashboard and identify security alerts. Define a SOC and explain its functions. Navigate the SIEM dashboard and identify security alerts. Security Monitoring Continuous monitoring, logs, alerts, detection methods. Splunk To monitor systems and identify suspicious activities. Import sample logs into Splunk and search for events. Explain why continuous monitoring is important. Search and identify suspicious events in logs. Log Analysis Types of log...
Read more

Month 11 – Programming & Automation for Cybersecurity

  Month 11 – Programming & Automation for Cybersecurity Note: This module teaches students how to use programming to automate security tasks, analyze data, and build simple cybersecurity tools. The emphasis is on defensive automation . Topic What I Will Discuss Tool What We Use the Tool For Practical Theory Assessment Practical Assessment Introduction to Programming for Cybersecurity Why cybersecurity professionals learn programming, programming languages, automation, scripting basics. Visual Studio Code To write, edit, and test scripts and programs. Install VS Code and write your first Python program. Explain why programming is important in cybersecurity. Write and run a Python program that prints a message. Python Basics Variables, data types, operators, input/output, comments. Python 3 To create automation scripts and security tools. Write programs using variables, calculations, and user input. Explain Python variables and data types. Develop a simple interactive Python pro...
Read more