Course overview
This course provides students with a comprehensive understanding of how to identify, collect, preserve and analyze digital evidence from storage devices such as hard drives, SSDs and external media.
The course focuses on the principle of forensic imaging, data recovery and analysis of file system while maintaining the integrity of evidence. Students will gain practical experience in using professional forensic tools to recover deleted, hidden, or encrypted data and to interpret digital traces relevant to investigations.
Emphasis is placed on the legal and ethical standards that guide digital evidence handling and reporting in forensic examinations.
Programme Details
- Duration: 2 Months.
- Mode: Offline (Hands-on Lab training).
- Batch Size: Limited to 5 students for individualised mastery.
- Location: A-525-527, Anthurium Tower, Noida Sector 73.
Topics covered
- Introduction to Computer Forensics and its importance with real life cases
- Different types of storage media and their types
- How HDD, SSD & Hybrid drive work and their parts
- Different types of interfaces of disk and their connectors
- Understanding Disk Structure and File Systems
- Types of data & How data store in a device
- Introduction to operating system
- Seizures of digital evidence and detailing
- Collection of evidence by disassembling
- Collection of evidence from running machine – RAM capturing
- Examination of Encrypted and Protected Volumes
- Introduction to Malware, rootkit & spyware
- Standard procedure for handling disk evidence
- Introduction to write blockers and their types
- Forensic Imaging and Evidence Acquisition
- Data Integrity Verification and Hashing Techniques
- Recovery of Deleted, Hidden, and Encrypted Data
- Metadata and File Signature Analysis
- Law related to Computer Forensic
- Chain of Custody and Evidence Management
- Forensic Report Preparation and Documentation
- Practical Case Study and Investigation Simulation
Hands-on Training list
- Parts/components of disks — identify and describe HDD and SSD components and their functions.
- RAM — locate and explain pagefile.sys and hiberfil.sys and where to check them.
- Registry — show where to find important registry values and how to view them.
- SOPs — write standard operating procedures covering the entire workflow up to courtroom presentation.
- Crime-scene photography — document proper crime-scene photography techniques and forensic investigative steps.
- Laptop disassembly — safely disassemble laptops and extract internal drives for analysis.
- Live forensics — detect whether a disk is encrypted and use an Encrypted Disk Detector (EDD).
- Live forensics — capture RAM correctly and preserve volatile evidence.
- VirusTotal — use VirusTotal for online malware scanning and interpreting results.
- Hashing — calculate and verify hash values using tools like Hash My Files and AccuHash.
- FTK – RAM Capture — hands-on practice creating forensically sound images and RAM captures.
- Volatility & CAINE — hands-on use of Volatility and CAINE for memory and system analysis.
- Data recovery — recover data from HDDs, SSDs, memory cards and USB drives, including common failure scenarios.
- TX1 procedures — perform TX1 tasks: hashing, secure wiping, recovery of formatted drives, full/partial/logical/physical imaging, and document each step.
- FTK tool kit : investigation procedure.
- Windows Forensic Investigation
- Mac forensic Investigation
- Reporting — prepare detailed forensic reports using Autopsy and FTK Toolkit with clear findings, methodology, and exhibits.
What will we learn?
- Understand and hands-on Forensic tools used in computer forensic.
- Understand the fundamentals of disk forensics and its importance in real-life investigations.
- Workflow and protocol followed in laboratories.
- Learn about bits, bytes, hexadecimal characters, ASCII, and Unicode encoding.
- Explore different types of memory: RAM, ROM, Cache, and registers, including system files.
- Identify and understand various storage devices: HDD, SSD, SSHD, optical drives, and enterprise storage.
- Calculate disk capacity using CHS addressing and measure hard disk performance.
- Understand SSD architecture: NAND flash, flash controllers, and pros/cons of SSDs.
- Learn about disk interfaces: PATA, SATA, SCSI, SAS, PCIe.
- Study registry files (SAM, SYSTEM, SOFTWARE, SECURITY, NTUSER.dat) and their forensic relevance.
- Differentiate between types of data: active, latent, hidden, archival, deleted, and overwritten.
- Understand disk space concepts: allocated vs. unallocated, slack space, unused space.
- Explore operating systems (Windows, macOS, Linux) and their components.
- Learn about file systems: FAT, NTFS, ReFS, HFS+, APFS, Ext2/3/4, ReiserFS, XFS, JFS, Btrfs.
- Understand the process of digital evidence seizure and chain of custody (COC).
- Learn the complete SOP from evidence seizure to courtroom presentation.
- Practice crime scene photography and CSI kit usage.
- Practice evidence collection from disassembled systems and running machines.
- Understand full disk encryption (FDE), its forensic challenges, and tools used for detection and decryption.
- Use tools like Encrypted Disk Detector, Elcomsoft, Passware Kit, BitLocker, VeraCrypt, and TrueCrypt.
- Capture RAM and perform logical file collection using FTK.
- Analyze malware using VirusTotal and understand types like spyware and rootkits.
- Learn hashing concepts and tools: MD5, SHA-1, SHA-256, Hash My Files, AccuHash.
- Follow standard lab procedures for handling disk evidence and documentation.
- Use write blockers (hardware/software) and understand NIST requirements.
- Operate forensic tools like Tx1 for hashing, wiping, and disk imaging.
- Analyze cases using FTK and Autopsy, and create detailed forensic reports.
- Explore additional forensic tools: Magnet AXIOM, VOLATILITY, Belkasoft, Paladin, Caine.
- Understand Indian laws related to disk forensics and digital evidence handling.
- Document and report findings from forensic extractions and analysis.
