IDFEInstitute of Digital Forensic Examiners
Free courses/IDFE-DFF

IDFE-DFF · Free

Digital Forensics Foundation

The common ground of every digital investigation: how evidence is identified, acquired, preserved, analysed and reported without losing its integrity.

4h · 7 modules · 21 lessons

Start free courseSign in

Sign in to save your progress and continue where you left off. It is free.

Course contents

01 Digital evidence fundamentals

  1. 1.1 What makes data evidence
  2. 1.2 Volatility and fragility
  3. 1.3 The forensic process

02 Legal and ethical principles

  1. 2.1 Legal authority and scope
  2. 2.2 Privacy and data protection
  3. 2.3 Ethics of the examiner

03 Identification and seizure

  1. 3.1 Recognising sources of evidence
  2. 3.2 Securing the scene
  3. 3.3 Seizure, packaging and transport

04 Acquisition and integrity

  1. 4.1 Acquisition types
  2. 4.2 Hash values and evidence integrity
  3. 4.3 Forensic images and write blocking

05 Chain of custody and documentation

  1. 5.1 Chain of custody records
  2. 5.2 Contemporaneous notes
  3. 5.3 Evidence storage and retention

06 Analysis fundamentals

  1. 6.1 File systems at a glance
  2. 6.2 Timestamps and time zones
  3. 6.3 Common artifacts

07 Reporting basics

  1. 7.1 What a report must contain
  2. 7.2 Stating limitations
  3. 7.3 Writing for non-specialists