Digital Forensics

This course introduces the principles, tools, and methodologies used to collect, analyze, and preserve digital evidence in support of security investigations and legal proceedings. Students will learn how digital forensics supports incident response, law enforcement, and compliance by uncovering the origin, scope, and impact of cyber incidents. Core topics include forensic science fundamentals, evidence handling, chain of custody, and legal considerations. Learners will gain hands-on experience using industry-standard tools to perform forensic imaging, recover deleted files, analyze file systems, and investigate artifacts from operating systems, networks, and applications. The course also covers memory analysis, log review, mobile device forensics, and techniques for detecting anti-forensic methods. Emphasis is placed on maintaining the integrity of evidence, documenting findings, and preparing reports suitable for organizational decision-making or use in court. By the end of the course, students will be able to conduct digital investigations ethically and effectively, while following best practices and adhering to legal and regulatory requirements. Learning Outcomes Explain digital forensics concepts, processes, and legal considerations Collect, preserve, and document digital evidence properly Use forensic tools to analyze systems, networks, and mobile devices Detect and counteract anti-forensic techniques Produce professional forensic reports for technical and legal audiences