Security / Governance, Risk & Compliance

Lead Digital Forensics Examiner.

Lead Digital Forensics Examiner training allows you to develop the knowledge and skills necessary to conduct digital forensics investigations. During this training, you will gain an in-depth understanding of digital incident investigation processes and techniques, including collecting, securing, analyzing and presenting digital evidence. You will learn how to apply best practices and specialized tools to investigate different types of devices and systems to uncover the causes of incidents and support investigations.

Issues

Computer forensics
Digital incident investigation process
Gathering digital evidence
Securing evidence
Digital data analysis
File systems
Network analysis
Memory analysis
Specialized investigative tools
Research reporting
Legal and ethical aspects
Research methodologies

Benefits

Master a structured methodology for conducting computer forensics research
Of the legal and ethical aspects of computer forensics will be enhanced
They will learn how to properly secure and analyze digital evidence from various sources
Development of skills to prepare professional investigative reports

Who is this training for?

Computer forensics and incident response specialists

Security analysts and cyber security specialists

Lawyers and law enforcement personnel

IT auditors and security consultants.

Prerequisites

Basic knowledge of information systems
Knowledge of the basics of IT security
Experience in working with computer systems
Analytical and logical thinking skills

Training program

Introduction to digital forensics — definition, objectives, applications, relationship with incident response (IR)
Legal and ethical aspects — digital evidence law, chain of custody, evidence admissibility, GDPR
Investigation methodologies — NIST SP 800-86, ISO/IEC 27037, forensic process (identification, collection, analysis, reporting)
Investigation preparation — planning, documentation, scene securing, tools and equipment
Digital evidence collection — disk imaging, bit-for-bit copies, write blockers, integrity verification (MD5/SHA hashing)
Exercises: forensic investigation planning, evidence preservation with chain of custody

File system analysis — FAT, NTFS, ext4, HFS+, deleted file recovery, metadata, timeline
Mobile device analysis — smartphones, tablets, data extraction, tools (Cellebrite, Oxygen)
Storage media analysis — HDD, SSD (TRIM, wear leveling), USB drives, memory cards
Windows artifact analysis — Registry, Event Logs, Prefetch, Jump Lists, LNK files, browser history
Linux/macOS artifact analysis — syslog, auth.log, bash_history, plist, Spotlight
Exercises: disk image analysis, file recovery, system artifact extraction

Network traffic analysis — PCAP, Wireshark, NetFlow, anomaly identification, session reconstruction
Memory (RAM) analysis — Volatility Framework, processes, network connections, injected code
Malware analysis — static and dynamic analysis basics, sandbox, IOC (Indicators of Compromise)
Log analysis — event correlation from multiple sources, timeline analysis, lateral movement identification
Email analysis — headers, phishing, spoofing, deleted message recovery
Exercises: RAM dump analysis, PCAP analysis, incident timeline construction

Investigation reporting — forensic report structure, evidence presentation, conclusions, recommendations
Evidence presentation — testimony preparation, communication with lawyers, technical vs non-technical presentation
Forensic laboratory management — procedures, accreditation, quality control, evidence storage
Forensic team management — roles, competencies, training, cooperation with SOC and IR
Anti-forensics — trace concealment techniques, encryption, steganography, how to detect them
Exercises: preparing a forensic investigation report, presenting findings

Digital forensics process summary — review of key concepts and techniques
Case studies — analysis of real-world forensic investigations (data breach, insider threat, fraud)
Trends in digital forensics — cloud forensics, IoT forensics, cryptocurrency forensics
PECB certification preparation — exam format, question types, passing strategies
Practice exam — PECB Certified Lead Digital Forensics Examiner exam simulation
PECB certification exam (optional) — written exam leading to PECB Certified Lead Digital Forensics Examiner certificate