Learning path
A structured path through digital forensics
Eleven modules that build on each other, from evidence integrity and time to operating-system, mobile and database artifacts, ending with timelines and reporting. Each module states its learning outcomes and points to the library entries to read, the tools to use and a case to practise on.
01~3 h
Foundations: integrity, documentation and method
What makes a finding repeatable: verified copies, contemporaneous notes and a clear line between observation and interpretation.
You will be able to
- Explain why examination happens on a verified copy and how a hash value supports that claim.
- Choose an appropriate hash algorithm and record it together with size, time and tool.
- Separate what an artifact records from what you infer from it.
Use and practise
02~4 h
Time: encodings, zones and normalisation
Every timeline is only as good as its time conversions. This module covers epochs, units, local time and daylight-saving edge cases.
You will be able to
- Recognise FILETIME, Unix, WebKit, Apple absolute and FAT values from their magnitude and context.
- Convert a local wall-clock time to UTC and identify ambiguous or non-existent local times.
- State the resolution and the zone of every timestamp you report.
Read
03~4 h
Files and file systems
Identify files by content rather than name, read raw structures in hex and understand what a file system records about each file.
You will be able to
- Identify a file type from its signature and explain an extension mismatch.
- Locate and interpret little-endian integers and timestamps in a hex view.
- Describe which time stamps a file system keeps and what changes them.
Read
Use and practise
04~6 h
Windows: program execution and user activity
The artifacts that show a program existed, was run, or a file was opened, and how much each one can actually prove.
You will be able to
- Distinguish evidence of presence from evidence of execution.
- Correlate at least two independent artifacts before stating that a program ran.
- Attribute user-specific artifacts to the right account.
Read
Use and practise
05~5 h
Windows: event logs, logons and devices
Read the Security, System and operational logs as evidence: what is logged by default, what depends on audit policy and how to reconstruct a session.
You will be able to
- Interpret logon types and pair logon with logoff events.
- Recognise which events depend on audit policy and what their absence means.
- Build a device-connection timeline from registry and log sources.
Read
Use and practise
06~4 h
Web browsers
History, downloads, cookies and sessions in Chromium and Firefox profiles, and how their time encodings differ.
You will be able to
- Query browser SQLite databases and convert their native time values.
- Distinguish a typed visit from a redirect or an automatic load.
- Explain how private browsing and profile sync affect what remains.
Read
Use and practise
07~4 h
macOS and Linux
Logs, file-system event records, quarantine data and shell history on Unix-like systems, and how their time stamps are stored.
You will be able to
- Locate authentication and session records on Linux and read their time format.
- Explain what the unified log, FSEvents and quarantine records add to a macOS timeline.
- Recognise when shell history lacks time stamps and what that means for a timeline.
Read
Use and practise
08~6 h
Mobile devices and messaging apps
System and application databases on Android and iOS: communication, usage and location records, and the identifiers that tie them to a device.
You will be able to
- Locate the main communication and usage databases on each platform.
- Convert Apple absolute and Unix millisecond values correctly.
- Validate an IMEI and explain what it does and does not identify.
Read
09~5 h
SQLite in depth
Most mobile and browser evidence lives in SQLite. Learn the page structure, the write-ahead log and why a query result is not the whole database.
You will be able to
- Read the database header and identify WAL mode.
- Explain why uncommitted or superseded WAL frames matter.
- Avoid type-affinity mistakes when comparing stored values.
Read
10~3 h
Document and media metadata
Exif, office document properties and PDF metadata: what they record, who can change them and how to corroborate them.
You will be able to
- Extract capture time, offset and GPS position from an image.
- Compare camera time with GPS time to detect clock drift.
- Treat embedded metadata as a claim to be corroborated.
Read
Use and practise
11~4 h
Timelines, correlation and reporting
Bring sources together into one UTC timeline, state confidence honestly and write a report another examiner can reproduce.
You will be able to
- Merge records from different sources with their offsets and resolution noted.
- Phrase findings at the level the evidence supports.
- Document tools, versions, hashes and steps so the work can be repeated.