Module 2 – Incident Handling
-
Section 1 – What is an Incident?
-
Section 2 – Incident Handling Steps
-
Phase 1: Preparation
-
Phase 2: Identification and Initial Response
-
Phase 3: Containment
-
Phase 4: Eradication
-
Phase 5: Recovery
-
Phase 6: Follow-up
Module 3 – Computer Forensic Investigative Theory
-
Section 1 – Investigative Theory
-
Section 2 – Investigative Concepts
-
Section 3 – BEA & EFA
Module 4 – Computer Forensic Investigative Process
-
Section 1 – Investigative Prerequisites
-
Section 2 – Investigation Process
Module 5 – Digital Acquisition
-
Section 1 – Acquisition Procedures
-
Section 2 – Evidence Authentication
-
Section 3 - Tools
Module 6 – Disks and Storages
-
Section 1 – Disk OS and Filesystems
-
Section 2 – Spinning Disks Forensics
-
Section 3 – SSD Forensics
-
Section 4 – Files Management
Module 7 – Forensic Examination Protocols
-
Section 1 – Science Applied to Forensics
-
Section 2 – Cardinal Rules & Alpha 5
-
Section 3 – The 20 Basic Steps of Forensics
Module 8 – Digital Evidence Protocols
-
Section 1 – Digital Evidence Categories
-
Section 2 – Evidence Admissibility
Module 9 – Digital Evidence Presentation
-
Section 1 – The Best Evidence Rule
-
Section 2 - Hearsay
-
Section 3 – Authenticity and Alteration
Module 10 – Computer Forensic Laboratory Protocols
Module 11 – Computer Forensic Processing Techniques
Module 12 – Specialized Artifact Recovery
-
Section 1 – Forensics Workstation Prep
-
Section 2 – Windows Components with Investigative Interest
-
Section 3 – Files Containing Historical Information
-
Section 4 – Web Forensics
Module 13 – eDiscovery and ESI
Module 14 – Mobile Forensics
-
Section 1 – Cellular Network
-
Section 2 – Forensic Process
-
Section 3 - Tools
-
Section 4 – Paraben Forensics
Module 15 – Digital Forensics Reporting