IDFEInstitute of Digital Forensic Examiners
Free courses/IDFE-CFX

IDFE-CFX · Free

Computer Forensic Examiner

Examination of computers and their storage: file systems, operating system artifacts, timelines and the traces users and attackers leave behind.

32h · 7 modules · 40 lessons

Start free courseSign in

Sign in to save your progress and continue where you left off. It is free.

Course contents

01 File systems

  1. 1.1 Disks, partitions and volumes
  2. 1.2 How file systems store data: clusters, allocation, slack and unallocated space
  3. 1.3 NTFS: the MFT, its records and attributes
  4. 1.4 NTFS metadata files: $LogFile, $UsnJrnl and alternate data streams
  5. 1.5 FAT32 and exFAT on removable media
  6. 1.6 ext4: inodes, extents, journal and timestamps
  7. 1.7 APFS: containers, volumes, snapshots and encryption
  8. 1.8 Recovering deleted files: metadata recovery vs carving

02 Windows artifacts

  1. 2.1 The Registry: hives, keys, LastWrite times and transaction logs
  2. 2.2 System and accounts: OS version, time zone, users and SIDs
  3. 2.3 Program execution: Prefetch, Amcache, Shimcache and BAM
  4. 2.4 File and folder access: LNK files, Jump Lists, RecentDocs and MRU lists
  5. 2.5 Shellbags
  6. 2.6 USB and external devices
  7. 2.7 Event logs: logons, RDP, services and PowerShell
  8. 2.8 SRUM and other activity databases
  9. 2.9 Recycle Bin and Volume Shadow Copies

03 Timeline analysis

  1. 3.1 Timestamp formats: FILETIME, Unix, Apple and DOS
  2. 3.2 MACB on NTFS: $SI vs $FN
  3. 3.3 Building a super timeline with Plaso
  4. 3.4 Pivoting and corroboration across sources
  5. 3.5 Time zone and clock errors

04 Browser, email and cloud sync

  1. 4.1 Chromium browsers: history, downloads, cookies and sessions
  2. 4.2 Firefox: places.sqlite and session data
  3. 4.3 Cache, private browsing and what survives
  4. 4.4 Email files and header analysis
  5. 4.5 Webmail and cloud accounts on the endpoint
  6. 4.6 Cloud sync clients: OneDrive, Google Drive and Dropbox

05 Memory and volatile data

  1. 5.1 Why memory matters, and acquisition
  2. 5.2 Volatility 3: processes, command lines and DLLs
  3. 5.3 Network connections, handles and injected code
  4. 5.4 Hibernation, page and crash files

06 macOS and Linux essentials

  1. 6.1 macOS: layout, plists and accounts
  2. 6.2 macOS activity: Unified Logs, FSEvents, KnowledgeC and Biome
  3. 6.3 Linux: layout, users, shell history and scheduled tasks
  4. 6.4 Linux logs: journald, auth logs, wtmp and btmp
  5. 6.5 Persistence on macOS and Linux

07 Anti-forensics

  1. 7.1 Wiping, deletion and cleaner tools
  2. 7.2 Timestomping, log clearing and hidden data
  3. 7.3 Encrypted volumes: BitLocker, FileVault and VeraCrypt