This course exceeded my expectations. The structure was perfect, building knowledge step-by-step. Really valuable content.
Digital Forensics: Fundamentals of Cyber Investigation
Learn how to investigate security breaches, analyze network traffic, and locate digital evidence through step-by-step written guides and practical scenarios.
-
💬
AI instructor
Ask about any lesson and get a clear answer instantly, anytime. -
🕐
Start anytime
No schedules or deadlines — learn at your own pace, whenever suits you. -
🌐
In English
Lessons, tasks and certificate — all fully in your language.
About this course
Course contents
6 modules · 28 lessons · 3h 2m
1
The Forensic Mindset & Legal Standards
Establish the legal and scientific foundation for digital investigations.
- The Science of Digital Forensics
Digital forensics is a structured, scientific approach to uncovering the truth behind security incidents.6 min - The Investigator’s Dictionary
Mastering core terminology is essential for professional communication and reporting.6 min - The Chain of Custody
Maintaining a rigorous log of evidence handling ensures integrity from the crime scene to the courtroom.7 min - Legal Admissibility & Ethics
Evidence is only useful if it meets legal standards and is collected ethically.6 min - The Golden Rule: Evidence Preservation
Learn to use write-blockers and imaging tools to analyze data without altering the original source.7 min
2
Incident Response Workflow
Learn how to manage an active threat and document the process.
- The IR Lifecycle
Understand the standard phases of incident response from preparation to lessons learned.6 min - Identification and Triage
Quickly determine the scope and severity of a security breach.6 min - Containment Strategies
Apply workflows to isolate infected systems and prevent further damage.6 min - Systematic Documentation
Every action taken during an investigation must be recorded to withstand scrutiny.7 min
3
Network Forensics & Log Analysis
Trace attacker movement through network traffic and system logs.
- The Network Trail
Identify where network evidence is stored and how to collect it.6 min - Analyzing Network Packets (PCAP)
Use packet analysis tools to see exactly what data was sent over the wire.7 min - Interpreting System Logs
Extract meaningful clues from OS and application logs to reconstruct events.7 min - Tracing Malicious Activity
Follow the breadcrumbs left by an attacker across the network infrastructure.7 min - Mapping the Incident
Create a visual map of the security incident to understand the attack flow.6 min
4
File System & Artifact Analysis
Locate and interpret evidence stored on local disks and within the OS.
- File System Methodologies
Understand how NTFS and FAT store data and how to navigate them forensically.6 min - Finding Local Storage Evidence
Locate hidden files, temporary data, and deleted items on physical storage.6 min - Windows Registry Fundamentals
The Registry is a goldmine for configuration changes and user activity traces.7 min - Deep Dive into Registry Keys
Identify specific keys that reveal connected devices and recent file access.7 min - Artifacts of Execution
Use Prefetch and Shimcache to prove that a specific program was run on the system.6 min
5
Memory Forensics
Analyze volatile data to find active threats and malware.
- The Power of Volatile Memory
Why RAM contains evidence that you will never find on a hard drive.6 min - Capturing System Memory
Tools and techniques for safely dumping RAM without crashing the system.6 min - Spotting Unauthorized Processes
Identify malicious processes hiding in plain sight within system memory.7 min - Detecting Malware Persistence
Analyze how malware ensures it restarts after a system reboot.7 min - Memory Artifact Extraction
Recover passwords, network connections, and chat logs directly from RAM.7 min
6
Synthesis & Final Reporting
Combine all evidence into a coherent investigation report.
- Building a Forensic Timeline
Correlate network, disk, and memory data into a single chronological sequence.7 min - Correlating Evidence
Link disparate pieces of data to prove the attacker's intent and identity.7 min - Professional Reporting
Draft a final report that is clear for both technical and non-technical stakeholders.7 min - Reviewing Forensic Principles
A final look at the core principles that ensure your investigation is valid.6 min
The 'Shadow Breach' Investigation Case
You are provided with a small dataset including a network capture (PCAP), a disk image fragment, and a memory dump from a compromised workstation. Your task is to reconstruct the attack timeline.
What you'll get
-
📜
Certificate of completion
Add it to your LinkedIn profile -
💬
Personal AI tutor
Stuck on a lesson? Ask your built-in tutor anything, any time. -
🎧
Audio version included
Learn on the go — no screen needed -
♾️
Lifetime access
Come back anytime, no expiry -
📱
Phone or computer
Works anywhere, any device -
💸
14-day refund
No questions asked -
⚡
Short & focused
3h 2m of practical content
Certificate of completion
Every course you complete on PickAClass issues a credential like this — original, with its own code, verifiable by URL, and detailed about what was actually demonstrated.
Reviews (4)
Pretty good foundation. The explanations were generally clear, and the structure made sense. I'd say it's a worthwhile course.
This course delivered exactly what I needed. The explanations were clear and concise. Big thumbs up!
Thoroughly enjoyed this course. The way the information was presented was excellent, and the practical applications were highlighted effectively. Great job!
Learners also took
Cybersecurity Foundations and Security+ SY0-701 Preparation
Cybersecurity Awareness and Identity Security Fundamentals
Cybersecurity Analyst: Modern Threat Defense and Response
Cybersecurity Awareness and Threat Defense for Employees
Frequently asked
What do I need to take this course? +
Just a phone or computer with internet. No installs, no special hardware.
How do I pay? +
By card via Stripe. We don’t store card details — Stripe handles them securely.
Can I get a refund? +
Yes — full refund within 14 days, no questions asked.
How long will I have access? +
Forever. Once you purchase, the course is yours to revisit anytime.
Will I get a certificate? +
Yes. On completion you'll receive a certificate you can add to your LinkedIn profile.
Get 10 courses a month
Members get 10 courses of their choice every month for 0 kr. No per-course charges — you pay only the subscription.
- ✓ 10 courses every month
- ✓ Cancel anytime
Renews monthly. Unused courses expire at the end of each billing month.