C)DFE: Digital Forensics Examiner

Modules:

• Module 01 – Forensics Incidents
• Module 02 – Forensic Investigative Theory
• Module 03 – Forensic Prerequisites and Standards
• Module 04 – Forensic Investigative Process
• Module 05 – Forensic Examination/Evidence Protocols
• Module 06 – Digital Acquisition and Analysis Tools
• Module 07 – Disks and Storages
• Module 08 – Live Acquisitions
• Module 09 – Windows Forensics
• Module 10 – Linux Forensics
• Module 11 – MAC Forensics
• Module 12 – Specialized Artifact Recovery       
• Module 13 – Advanced Search Strings and File Signatures
• Module 14 – Mobile Forensics
• Module 15 – eDiscovery
• Module 16 – Computer Forensic Laboratory Protocols
• Module 17 – Digital Evidence Presentation and Reporting  

Labs: 

• Lab 01 – Chain of Custody
• Lab 02 – Identify Seized Evidence
• Lab 03 – Device Acquisition
• Lab 04 – Memory Acquisition
• Lab 05 – Prepare the Case Evidence
• Lab 06 – Investigate the Acquired Evidence
• Lab 07 – Add Additional Case Evidence
• Lab 08 – Windows Event Logs Analysis
• Lab 09 – Linux Primary Info Retrieval
• Lab 10 – Investigate OSX Evidence
• Lab 11 – Finding Clues
• Lab 12 – Regex
• Lab 13 – Data Carving
• Lab 14 – Specialized Artifact Recovery
• Lab 15 – Construct the Case Events
• Lab 16 – Tie Evidence to Android
• Lab 17 – Incident Response

DETAILED OUTLINE

Module 1 – Computer Forensics Incidents       

• Origins of digital forensic science
• Legal System
• Types of Cybercrime Incidents
• Internal and external threats

Module 2 – Computer Forensic Investigative Theory    

• Investigative Theory
• Investigative Concepts
• Behavioral evidence analysis (BEA) & Equivocal Forensic Analysis (EFA)

Module 3 – Computer Forensic Prerequisites and Standards    

• Investigative Prerequisites
• Scene Management
• Industry Standards

Module 4 – Computer Forensic Investigative Process   

• Foundations of the Digital Forensics Process
• Identification & Scope
• Collection & Preservation
• Examination
• Analysis & Interpretation
• Documentation & Interim Reporting
• Quality Control & Review

Module 5 – Forensic Examination/Evidence Protocols 

• Science Applied to Forensics
• Digital Evidence Categories
• Evidence Admissibility

Module 6 – Digital Acquisition and Analysis Tools

• Acquisition Procedures
• Computer forensics field triage process model (CFFTPM)
• Evidence Authentication
• Forensic Tools
• AI and Forensics

Module 7 – Disks and Storages

• Disk OS and Filesystems
• Spinning Disks Forensics
• SSD Forensics (IoT-Mention)
• Cloud Storage
• Handling Damaged Drives

Module 8 – Live Acquisitions

• Live Acquisition
• Windows Acquisition
• MacOS Acquisition
• Linux/UNIX Acquisition
• Cloud/Virtualization Acquisition

Module 9 – Windows Forensics

• Windows Event Viewer Overview
• EVTX and EVT Logs
• Logs Analysis to Identify Breaches and Attacks

Module 10 – Linux Forensics

• Linux Artifacts
  • File System Structure
  • Basic Identifiers
  • Common Log Files

Module 11 – MAC Forensics

• OSX Artifacts
  • File System Structure
  • Default Apps
  • Other Artifacts

Module 12 – Specialized Artifact Recovery      

• Windows Components with Investigative Interest
• Files Containing Historical Information
• Web Forensics
• Memory Forensics

Module 13 – Advanced Search Strings and File Signatures

• Search Strings
• REGEX (Regular Expressions)
• Files Signatures (Formats, Headers, and HEX Analysis)

Module 14 – Mobile Forensics 

• Forensic Process
• Tools
• IoT and Wearables
• Legal Considerations

Module 15 – eDiscovery

• eDiscovery
• Laws and Regulations
• eDiscovery Process

Module 16 – Computer Forensic Laboratory Protocols

• Forensics Workstation Prep
• Forensics Lab Standard Operating Procedures
• Quality Assurance
• Quality Control
• Peer Review
• Annual Review
• Deviations
• Lab Intake

Module 17 – Digital Evidence Presentation and Reporting       

• The Best Evidence Rule
• Hearsay
• Authenticity and Alteration
• Report Sections and Content