Capability Development / Cyber Security
Digital Forensics Essentials (DFE)
Digital Forensics Essentials provides a practical foundation in digital investigations, evidence handling, forensic analysis, and incident response support. Through guided labs and case-based scenarios, learners gain hands-on exposure to disk, file system, network, email, dark web, and malware forensics. The program prepares participants to detect, analyze, and document unauthorized activity in a structured, forensically sound manner, and builds readiness toward the EC-Council DFE certification exam.
Program Overview
Digital Forensics Essentials provides a practical foundation in digital investigations, evidence handling, forensic analysis, and incident response support. Through guided labs and case-based scenarios, learners gain hands-on exposure to disk, file system, network, email, dark web, and malware forensics. The program prepares participants to detect, analyze, and document unauthorized activity in a structured, forensically sound manner, and builds readiness toward the EC-Council DFE certification exam.
Audience Profile
Aspiring digital forensic investigators; IT and security support staff; Incident response team members; Students preparing for the EC-Council DFE exam; and Basic IT and operating systems knowledge recommended.
Course Syllabus
Module 1: Computer Forensics Fundamentals & Investigation Process
Topics
- Fundamentals of computer forensics
- Digital evidence and forensic readiness
- Roles of a forensic investigator
- Legal compliance in computer forensics
- Pre-investigation, investigation, and post-investigation phases
Labs / Practice
- Perform hash/HMAC calculations
- Compare hash values to check file integrity
- Create a disk image file of a hard disk partition
Module 2: Disk Structures, File Systems & Data Acquisition
Topics
- Disk drive types and characteristics
- Logical structure of a disk
- OS booting processes
- Windows, Linux, and Mac file systems
- Data acquisition types and formats
- Data acquisition methodology
Labs / Practice
- Analyze the file system of a Linux image
- Recover deleted files from hard disks
- Create an image of a system drive and convert to a bootable VM
- Acquire RAM from Windows workstations
Module 3: Anti-Forensics Techniques
Topics
- Anti-forensics concepts
- Anti-forensics countermeasures
Labs / Practice
- Perform SSD file carving on a Windows file system
- Recover data from a lost or deleted disk partition
- Crack application passwords
- Detect steganography
Module 4: Windows, Linux & Mac Forensics
Topics
- Volatile and non-volatile information collection
- Windows memory and registry analysis
- Browser cache, cookie, and history artifacts
- Windows files and metadata
- Filesystem image analysis with The Sleuth Kit
- Mac forensics fundamentals
Labs / Practice
- Acquire volatile information from a live Windows system
- Investigate a forensic image of Windows RAM
- Examine web browser artifacts
- Perform forensic investigation on a Linux memory dump
Module 5: Network & Web Attack Forensics
Topics
- Network forensics fundamentals
- Event correlation concepts and types
- Indicators of compromise from network logs
- Network traffic investigation
- Web application forensics
- IIS and Apache web server logs
Labs / Practice
- Identify and investigate network attacks using Wireshark
- Identify and investigate web application attacks using Splunk
Module 6: Dark Web & Email Forensics
Topics
- Dark web concepts
- Dark web and Tor browser forensics
- Email basics
- Email crime investigation steps
Labs / Practice
- Detect Tor browser activity on a machine
- Analyze RAM dumps to retrieve Tor browser artifacts
- Investigate a suspicious email
Module 7: Malware Forensics
Topics
- Malware components and distribution methods
- Types of malware analysis
- Static malware analysis
- Dynamic malware analysis
- System behavior analysis
- Network behavior analysis
Labs / Practice
- Perform static analysis on a suspicious file
- Forensic examination of a suspicious Office document
- Perform system behavior analysis