LegalForensic Report WritingWrite clear forensic reports that answer the questions asked and survive cross-examination.Basics of Cyber Forensics
Start here. Evidence handling, imaging, hashing, chain of custody and your first analysis.
- Beginner
- Online or on campus
- 5 hands-on labs
- 6 modules
About this course
Think of a police team walking into a small office after a complaint of online fraud. There is a desktop still running, two phones on the table, a pen drive in a drawer and a router in the corner. What do they pick up first? Should they switch the computer off? How do they prove later that nothing was changed? This course answers those questions from the beginning.
You learn what digital evidence is, where it hides and why it is fragile. You follow the full forensic process: identification, preservation, collection, examination, analysis and reporting. You practise the core habits of the field. Photograph before touching, isolate phones from the network, record the order of volatility, image instead of browsing the original, hash everything and fill the chain of custody form every time the evidence changes hands.
By the end you will have imaged a pen drive, verified it with hashes, opened it in Autopsy and pulled out basic Windows artefacts such as recent files, USB history and browser history. You will also know the Indian laws that frame this work, so later courses make sense.
Digital evidenceChain of custodyImaging and hashingWindows artefacts
After this course you can
- Explain what digital evidence is and the main places it is found on computers, phones and networks
- Follow the forensic process from identification to reporting and say why each step matters
- Handle a scene safely: photograph, isolate phones, decide on live or dead acquisition and seal items
- Create a forensic image with FTK Imager and verify it with MD5 and SHA-256 hashes
- Fill a chain of custody record that would satisfy a court or a lab audit
- Open an image in Autopsy and find basic artefacts such as recent files, USB history and web history
Syllabus
6 modules · 25 topics
01What digital evidence is4 topics
- Computers, phones, storage media, cloud accounts, CCTV and network logs
- Volatile and non-volatile data
- Order of volatility (RFC 3227) in plain terms
- Types of cyber cases: fraud, harassment, data theft, ransomware
02The forensic process4 topics
- Identification, preservation, collection, examination, analysis and reporting
- Guidance followed in the field: ISO/IEC 27037 and the ACPO principles
- Working on a copy, never the original
- Keeping notes that another examiner could repeat
03At the scene5 topics
- Photographing and sketching before anything is touched
- Running computer or switched off: when to capture RAM first
- Phones: airplane mode, Faraday bags and keeping the battery alive
- Spotting encryption, cloud sync and remote wipe risks
- Packing, sealing and labelling items
04Imaging, hashing and chain of custody4 topics
- What a bitstream image is and why it includes deleted space
- Write-blockers and why they matter
- Hash values as a fingerprint of data: MD5, SHA-1 and SHA-256
- Chain of custody forms, seals and evidence registers
05First look at an image4 topics
- Opening an image in Autopsy
- File system view, deleted files and keyword search
- Windows artefacts: recent files, prefetch, USB history and event logs
- Browser history and downloads
06The legal frame in India4 topics
- The Information Technology Act 2000 and its main offences
- Bharatiya Sakshya Adhiniyam 2023 and the Section 63 certificate for electronic records
- Bharatiya Nagarik Suraksha Sanhita 2023 and video recording of search and seizure
- Privacy and consent in workplace investigations
Hands-on labs
- Lab 1
Walk through a mock office fraud scene, decide what to seize first and complete the seizure notes
- Lab 2
Image a pen drive with FTK Imager and match the acquisition and verification hashes
- Lab 3
Change one byte in a copy of a file and see how the hash changes completely
- Lab 4
Fill a chain of custody form for an item that passes through three people
- Lab 5
Find USB history and recently opened files in a practice Windows image using Autopsy
Tools you will use
- FTK Imager
- Autopsy
- The Sleuth Kit
- HashMyFiles
- Magnet RAM Capture
- ExifTool
- HxD hex editor
Who it suits
- Students of BSc, BCA, BTech, forensic science or law who want to enter digital forensics
- Police officers and cyber cell staff who attend scenes and seize devices
- Company IT staff who are the first to respond to an incident
- Advocates and legal staff who want to understand how digital evidence is made
Before you join
- Basic computer use, nothing more
- No programming or forensic experience needed
Questions about this course
I have no technical background. Can I join?
Yes. This course is written for beginners. If you can use a Windows computer and install software, you can follow every lab.
Which course should I take after this one?
Most learners move to HDD Forensics or Android Forensics, depending on the cases they expect to handle. Forensic Report Writing is a good next step for anyone who will write reports soon.
Will I use real forensic software?
Yes. You work with FTK Imager, Autopsy and other tools that are used in labs, along with practice evidence images built for training.
Does this course count towards a certification?
Yes. It counts towards the DCFA (Digital Forensic Analyst) certification.
More courses in Foundation & Legal Courses
LegalForensic Report WritingWrite clear forensic reports that answer the questions asked and survive cross-examination.
LegalLegal & Court ProceduresIndian law on electronic evidence: BSA Section 63, BNSS search and seizure and the IT Act.Not sure this is the right one for you?
Tell us your background and what you want to do next. A counsellor will suggest a course and the next batch.