IDFEInstitute of Digital Forensic Examiners
Sign in
HomeFree coursesDFF
IDFE-DFFFoundationFree course

Digital Forensics Foundation

The common ground of every digital investigation: how evidence is identified, acquired, preserved, analyzed and reported without losing its integrity.

Modules
7
Lessons
21
Length
About 4 h
Pace
Self-paced
Languages
EN · ES · PT
Free · about 4 hStart course

What you will learn

By the end of the course you will be able to:

  1. 01Tell data, information and evidence apart, and apply the ISO/IEC 27037 principles of relevance, reliability and sufficiency.
  2. 02Work inside your legal authority and written scope, protect privacy and act as an impartial examiner.
  3. 03Recognize where evidence may be and secure a scene without changing it.
  4. 04Choose an acquisition type and prove integrity with hash values and write blocking.
  5. 05Keep chain of custody records and contemporaneous notes that hold up under review.
  6. 06Read file systems, timestamps and common artifacts, and corroborate what they show.
  7. 07Write a report that answers the questions asked, states its limitations and reads clearly to non-specialists.

Before you start

This is a foundation course in forensics, not in IT. It assumes you already know how computers and networks work.

Prerequisites
  • Operating systemsYou use Windows, macOS or Linux beyond the basics: the file system, users and permissions, processes, the command line and system logs.
  • NetworksIP addressing, DNS, DHCP, common protocols (HTTP, HTTPS, SMTP) and what routers and firewalls do.
  • Hardware and storageHard disks, SSDs, memory cards, RAM, and how a device starts up.

Typical background: Two or more years in IT support, systems, networks or security, or a degree in computing.

Not needed
  • Previous forensic experience
  • Forensic software or a lab
  • A legal or law-enforcement background
Coming from law or audit?

You can follow the course, but some lessons will need extra reading on operating systems and networks first.

Are you ready? Take the 2-minute self-check

5 questions on operating systems and networks. Nothing is saved or graded.

Recommended pathDFFCFXorMFXFRETA recommendation, not a rule: every course and exam is open to anyone, in any order.

How to get the most from it

Short, regular sessions work better than one long read.

  1. 1
    Go in order

    Each lesson builds on the one before, and later modules refer back to earlier ones.

  2. 2
    One module per sitting

    A module is about 20 minutes of reading. Add 10 minutes for the checks and your notes.

  3. 3
    Read the Exam focus box first

    It says what the exam expects from that lesson, so you read with a purpose.

  4. 4
    Answer before you look

    Commit to an answer in each knowledge check, then read the explanation, even when you were right.

  5. 5
    Redraw the diagram

    Every lesson has one diagram that sums it up. If you can sketch it from memory, you have the lesson.

  6. 6
    Sign in and come back

    Your place is kept and finished lessons are marked, so short sessions add up.

A suggested plan: 4 sessionsOver one or two weeks
SessionModulesTopicsTime
11 and 2What evidence is, the law and ethics~40 min
23 and 4Seizure, acquisition, hashes and write blocking~45 min
35 and 6Custody, notes, file systems and timestamps~40 min
47 + reviewReporting, then every knowledge check again~50 min

Ready for the exam? When you can answer the knowledge checks without looking back at the lesson.

Course content

7 modules · 21 lessons · 2 h 9 min of reading. Each module is one domain of the exam.

01Digital evidence fundamentals3 lessons · 17 minExam 15%
  1. 1.1What makes data evidence6 min
  2. 1.2Volatility and fragility6 min
  3. 1.3The forensic process5 min
02Legal and ethical principles3 lessons · 19 minExam 10%
  1. 2.1Legal authority and scope7 min
  2. 2.2Privacy and data protection6 min
  3. 2.3Ethics of the examiner6 min
03Identification and seizure3 lessons · 20 minExam 15%
  1. 3.1Recognising sources of evidence7 min
  2. 3.2Securing the scene7 min
  3. 3.3Seizure, packaging and transport6 min
04Acquisition and integrity3 lessons · 19 minExam 20%
  1. 4.1Acquisition types7 min
  2. 4.2Hash values and evidence integrity6 min
  3. 4.3Forensic images and write blocking6 min
05Chain of custody and documentation3 lessons · 18 minExam 15%
  1. 5.1Chain of custody records6 min
  2. 5.2Contemporaneous notes6 min
  3. 5.3Evidence storage and retention6 min
06Analysis fundamentals3 lessons · 18 minExam 15%
  1. 6.1File systems at a glance6 min
  2. 6.2Timestamps and time zones6 min
  3. 6.3Common artifacts6 min
07Reporting basics3 lessons · 18 minExam 10%
  1. 7.1What a report must contain6 min
  2. 7.2Stating limitations6 min
  3. 7.3Writing for non-specialists6 min

Who it is for

IT and security professionals moving into forensics, and anyone who handles, requests or relies on digital evidence. Lawyers and auditors are welcome, with some extra reading on operating systems and networks.

Questions

Is the course really free?

Yes. Every lesson is free to read, with or without an account. You only pay if you decide to take the certification exam.

Do I need the course to take the exam?

No. The exam is independent and open to anyone. The course covers every exam domain, with the weights shown under Course content.

Do I get a certificate for finishing the course?

No. Finishing marks the course as complete in your account. The IDFE-DFF credential comes only from passing the exam.

Which languages is it in?

English, Spanish and Portuguese. Switch at any time with EN · ES · PT at the top of the page.