Course · NCFI
NSD Certified Forensic Investigator
From evidence acquisition to the report, on Windows and Linux.
A course by the Cyber Law & First Response Initiative, an ISAC Foundation centre.
- Length
- 68 hours
- Format
- Self-paced e-learning with live ask-me-anything sessions
- Certification
- NSD Cadet certificate (hands-on labs and theory examination); two attempts to pass
- Before you start
- NCBIS and NCPT preferred
About the course
A programme on investigating Windows and Linux systems, from evidence acquisition to reporting. Learners gain real-world forensic investigation skills through hands-on labs hosted in the cloud by Cyberange.
What you become
An NSD Cadet-certified forensic investigator who can identify, collect, analyse and preserve digital evidence.
Who it is for
- Security researchers
- Students and professionals keen on forensic investigation
- Security teams
- Law-enforcement agencies
- Military and police personnel
Curriculum
Digital forensics
tools, techniques and research challenges; stages, digital evidence and chain of custody
Hard disks and file systems
NTFS and Ext4
Data acquisition
imaging and cloning, hashing, write blockers, FTK Imager
File system analysis with The Sleuth Kit
Windows forensics
registry, Recycle Bin, Jump Lists, Prefetch, execution artifacts
Anti-forensics and anti-anti-forensics
data hiding, secure deletion, timestomping
Volatile memory forensics with Volatility
Linux forensics
users and groups, file hunting, failed logins, journal timestamps
Email and drone forensics
Password recovery
cracking methods and tools, Hashcat
Mobile and Android forensics
SIM file system, locks, rooting, acquisition
What is included
- 60 days of Cyberange virtual labs: cyber forensics, malware, password cracking and more
- 60 days of LMS access
- Tools: Kali Linux, FTK Imager, The Sleuth Kit, Volatility, Hashcat, EnCase, FTK and Autopsy
Enrol
Send an enquiry to the Cyber Law & First Response Initiative from this page.