Membership

Digital Forensic Imaging - Tools & Methods (W47)

Develop a practical understanding of forensic imaging tools and methods. Study acquisition choices, image integrity, and the steps needed to prepare digital evidence for analysis. Intended audience: Who is this course for? This course is for anyone interested in computer forensics or computer forensic examiners looking for more detail in computer forensic imaging or seeking to add to their credentials and enhance their skill set.

Instructor · David Tatum

Modules:
6
Lessons:
116

eForensics learning

Practical skills.
Verified progress.

What you'll learn

  • Create and verify forensic images.
  • Use hashing to check file integrity.
  • Select acquisition methods appropriate to the evidence.

Prerequisites

The student shall have a basic understanding of computer hardware, operating system file structure and how to navigate common components of software interfaces such as opening, closing, and naming files. The student should also be able to research, download and install different forensic imaging tools. While detailed knowledge of binary calculations is not necessary, the student should be aware of different number systems including hexadecimal and binary. Equipment and software: Windows 10 computer with access to the Internet. The computer should meet the recommended requirements for running Windows 10

Module 2

Module 1

  1. 1. (W47M01) History - Standards - Preservation

  2. 2. Practice: W47M01Q01T09

  3. 3. Practice: W47M01Q01T10

  4. 4. (W47M02) Drive Geometry

  5. 5. (W47M03) Drive Geometry - Simulation

  6. 6. (W47M04) Navigating the OS

  7. 7. (W47M06) Mounting an image - Simulation

  8. 8. (W47M07) Navigating the GUI - Simulation

  9. 9. (W47M05) OS and imaging - Simulation

  10. 10. Practice: (W47M01Q03T06)

  11. 11. (W47M08) Forensic Workstation

  12. 12. (W47M09) Hashing - Image Type - Verification

  13. 13. (W47M10) Converting image types - Simulation

  14. 14. Practice: (W47M01Q05T09)

Assessments

Quiz Required

(W47M01Q01) History, Standards and Evidence Preservation - Quiz

Quiz Required

(W47M01Q03) Navigating OS - Quiz

Quiz Required

(W47M01Q05) Image types, Verification, Hashing - Quiz

Module 3

Module 2

  1. 1. (W47M11) Imaging tool requirements

  2. 2. Practice: (W47M02Q02T02)

  3. 3. Practice: (W47M02Q02T04)

  4. 4. Practice: (W47M02Q02T10)

  5. 5. Practice: (W47M02Q02T16)

  6. 6. (W47M12) Logicube

  7. 7. (W47M13) Logicube - Simulation

  8. 8. (W47M14) Atola

  9. 9. (W47M15) Atola - Simulation

  10. 10. (W47M16) KAPE

  11. 11. (W47M17) KAPE Demo

  12. 12. (W47M18) KAPE - Simulation

  13. 13. (W47M19) Live Response

  14. 14. (W47M20) Live Response Demo

  15. 15. (W47M21) Live Response - Simulation

  16. 16. (W47M22) PowerShell WMI Scripting

  17. 17. (W47M23) WMI Demo

  18. 18. (W47M24) Scripting with WMI and PowerShell - Simulation

  19. 19. (W47M25) FTK Imager

  20. 20. (W47M26) FTK Imager Demo

  21. 21. (W47M27) FTK Imager - Simulation

  22. 22. (W47M28) Autopsy

  23. 23. (W47M29) Autopsy Demo

  24. 24. (W47M30) Autopsy - Simulation

  25. 25. (W47M31) Linux dd

  26. 26. (W47M32) Linux dd - Simulation

  27. 27. Practice: W47M02Q01T06

  28. 28. Practice: W47M02Q01T08

Assessments

Quiz Required

(W47M02Q02) Tool requirements - QUIZ

Quiz Required

(W47M02Q01) DF Tools - QUIZ

Module 4

Module 3

  1. 1. (W47M33) Forensically Sound Imaging

  2. 2. (W47M34) Physical Extraction

  3. 3. (W47M35) Physical Extraction - SIMULATION

  4. 4. Practice: W47M03Q02T01

  5. 5. Practice: W47M03Q02T05

  6. 6. (W47M36) Bitstream copies

  7. 7. (W47M37) Logical Extraction

  8. 8. (W47M38) Logical Extraction - SIMULATION

  9. 9. (W47M39) Targeted Extraction

  10. 10. Practice: W47M03Q05T08

  11. 11. (W47M40) HDD/SSD Imaging - Disk Imaging

  12. 12. (W47M41) EnCase Imager

  13. 13. (W47M42) Mounting an ISO

  14. 14. (W47M43) BitLocker Image

  15. 15. (W47M44) Drive Imaging - EnCase - SIMULATION

  16. 16. (W47M45) Drive Imaging - ISO - SIMULATION

  17. 17. (W47M46) Drive Imaging - Challenge - SIMULATION

  18. 18. Practice: W47M03Q06T02

  19. 19. (W47M47) Memory Imaging

  20. 20. (W47M48) RAM Forensic Analysis

  21. 21. (W47M49) NTUSER DAT -SIMULATION

  22. 22. Practice: W47M03Q07T09

  23. 23. (W47M50) Cloning vs Imaging

  24. 24. (W47M51) Hashing - SIMULATION

Assessments

Quiz Required

(W47M03Q01) Forensically Sound Imaging Quiz

Quiz Required

(W47M03Q02) Physical Extraction

Quiz Required

(W47M03Q03) Bitstream Copies

Quiz Required

(W47M03Q04) Logical Extraction

Quiz Required

(W47M03Q05) Targeted Collection

Quiz Required

(W47M03Q06) HDD and SSD Imaging

Quiz Required

(W47M03Q07) Memory Imaging

Quiz Required

(W47M03Q08) Cloning vs Imaging

Module 5

Module 4

  1. 1. (W47M52) RAID Imaging

  2. 2. (W47M00) RAID - Simulation

  3. 3. Practice: W47M04Q01T06

  4. 4. Practice: W47M04Q01T08

  5. 5. (W47M53) Virtual Machines and VHD

  6. 6. (W47M00) VM - Simulation

  7. 7. (W47M00) VHD - Simulation

  8. 8. (W47M00) VHD Hashing - Simulation

  9. 9. Practice: W47M04Q02T02

  10. 10. (W47M54) Enterprise Triage

  11. 11. Practice: W47M04Q03T06

  12. 12. Practice: W47M04Q03T07

  13. 13. Practice: W47M04Q03T09

  14. 14. (W47M55) Remote Networks

  15. 15. (W47M00) Network - Simulation

  16. 16. Practice: W47M04Q04T18

  17. 17. Practice: W47M04Q04T20

  18. 18. Practice: W47M04Q04T25

  19. 19. (W47M56) Cloud Considerations

  20. 20. (W47M00) Cloud - Simulation

  21. 21. Practice: W47M04Q05T03

  22. 22. Practice: W47M04Q05T13

  23. 23. Practice: W47M04Q05T15

  24. 24. Practice: W47M04Q05T18

  25. 25. (W47M57) SaaS

  26. 26. Practice: W47M04Q06T03

  27. 27. (W47M58) Mobile Devices

  28. 28. (W47M00) Mobile - Simulations

  29. 29. (W47M00) GPS Data - Simulation

  30. 30. Practice: W47M04Q07T05

  31. 31. (W47M59) Legal Aspects

  32. 32. Practice: W47M04Q08T09

  33. 33. (W47M60) DFI Future

  34. 34. Practice: W47M04Q09T01

  35. 35. Practice: W47M04Q09T02

  36. 36. Practice: W47M04Q09T06

Assessments

Quiz Required

(W47Q09) RAID Imaging - Quiz

Quiz Required

(W47Q10) Virtual Machines - Quiz

Quiz Required

(W47Q11) Triage - Quiz

Quiz Required

(W47Q12) Remote Networks - Quiz

Quiz Required

(W47Q13) Cloud - Quiz

Quiz Required

(W47Q14) SaaS - Quiz

Quiz Required

(W47Q15) Mobile - Quiz

Quiz Required

(W47Q16) Legal - Quiz

Quiz Required

(W47Q17) Future of Imaging - Quiz

Course access

Unlock Digital Forensic Imaging - Tools & Methods (W47).

Enter your email. We’ll send a sign-in code here without taking you away from this course.