Digital Forensics Essentials

Digital Forensics Essentials

位教师：Gilbert George

访问权限由 Coursera Learning Team 提供

6个模块

深入了解一个主题并学习基础知识。

初级等级

推荐体验

9 小时完成

灵活的计划

自行安排学习进度

6个模块

深入了解一个主题并学习基础知识。

初级等级

推荐体验

9 小时完成

灵活的计划

自行安排学习进度

您将学到什么

Explain the foundational role and scope of digital forensics in cyber security and its application across real-world cyber-crime investigations.
Apply standard cyber-crime investigation process to collect and preserve digital evidence using forensic tools.
Perform foundational cyber forensics analysis on digital media using industry-standard tools aligned with computer forensics best practices.
Create concise reports documenting digital evidence findings and digital forensic analysis for real-world cyber-crime investigations.

您将获得的技能

您将学习的工具

要了解的详细信息

可分享的证书

添加到您的领英档案

作业

4 任务¹

AI 评分请参见免责声明

授课语言：英语（English）

了解顶级公司的员工如何掌握热门技能

了解关于 Coursera for Business 的更多信息

Petrobras, TATA, Danone, Capgemini, P&G 和 L'Oreal 的徽标

该课程共有6个模块

Are You Ready to Uncover the Truth Hidden in Digital Evidence?

Digital forensics is not just for law enforcement agents and agencies. It is for anyone who wants to understand how to investigate cyber incidents, recover deleted files, trace unauthorized activity, and ensure the integrity of digital systems. In a world where almost every cyber-crime leaves a digital footprint, knowing how to collect and analyze that evidence is essential. Whether you want to pursue a career in digital forensics, protect your organization from insider threats, or simply understand how cyber-crime investigations work, this course is your gateway to the fast-growing field of digital forensic investigation. This beginner-friendly digital forensics course will demystify the process of cyber-crime investigation and give you the confidence to analyze digital evidence, use cybercrime investigation tools, and build defensible reports. You'll explore file systems, memory analysis, data acquisition, and reporting techniques - all through clear explanations and practical hands-on labs aligned with digital forensics essentials. Unlike a one-size-fits-all tutorial, digital forensic analysis requires precision, patience, and a strong sense of ethics. This course will guide you step-by-step through real-world cybercrime investigation scenarios, forensic best practices, and essential toolkit, helping you uncover and preserve digital evidence with clarity and confidence, following a structured cyber-crime investigation process. This course is designed for IT professionals transitioning into cybersecurity, computer forensics and digital forensics beginners building foundational skills, law enforcement and legal professionals working with digital evidence, and anyone curious about how cybercrimes are investigated and solved including aspiring cyber-crime investigators, digital forensics investigators, and cyber forensic investigators. Learners should have basic computer literacy, familiarity with operating systems such as Windows or Linux, and a genuine curiosity about cybersecurity or digital forensic investigation to make the most of this course. By the end of this digital forensics certification-aligned course, you will be able to explain the role of digital forensics in cyber security, collect and preserve digital evidence using standard forensic procedures, perform foundational digital forensics analysis with industry tools, and create clear, structured reports that document your investigative findings. You will also build the confidence to approach cyber forensic investigations methodically and ethically in real-world scenarios.

In this course, you’ll learn how to investigate digital evidence step-by-step using the core principles and tools of modern digital forensics. You’ll explore how to identify, acquire, and preserve data from computers and storage devices, recover deleted artifacts, and trace user activity across file systems and system logs. Through guided instruction, hands-on labs, and real-world investigative scenarios using tools like FTK Imager, Autopsy, and dd, you’ll build the skills to perform basic forensic analyses, validate evidence integrity, and document your findings in clear, defensible reports—preparing you to support cybersecurity incidents, legal cases, or organizational investigations with confidence.

涵盖的内容

1个视频1篇阅读材料

This module introduces learners to the foundational concepts of digital forensics and its critical role in cybersecurity investigations. It explores how digital forensics supports incident response, evidence collection, and legal proceedings, while also addressing ethical and operational boundaries.

涵盖的内容

10个视频2篇阅读材料1个作业1次同伴评审1个讨论话题

10个视频总计56分钟

Module Introduction 2分钟
What Is Digital Forensics8分钟
The Forensic Process 7分钟
Types of Digital Evidence 5分钟
Where Digital Forensics Fits in the Cybersecurity Life Cycle 5分钟
Real-World Use Cases: Insider Threats 4分钟
Potential Sources of Evidence 10分钟
Chain of Custody and Admissibility in Court 4分钟
Privacy, Consent, and Ethical Boundaries 6分钟
Regional and International Laws Impacting Digital Evidence 5分钟

2篇阅读材料总计10分钟

A Proactive Approach to Network Forensics Intrusion Using Dynamic Feature Selection and Convolution Neural Network 5分钟
What Is Digital Chain of Custody 5分钟

1个作业总计20分钟

The Role of Digital Forensics in Cybersecurity20分钟

1次同伴评审总计20分钟

Hands-On-Learning: Matching the Digital Forensics Process with the Right Activity 20分钟

1个讨论话题总计10分钟

Primary Goals of Digital Forensics in Cybersecurity10分钟

In this module, you’ll learn how digital evidence is acquired and preserved in a way that keeps it reliable, defensible, and legally admissible. We’ll walk through the full acquisition process—from understanding image formats and handling devices safely to using tools like FTK Imager and dd for accurate disk imaging. You’ll also explore hashing, write blockers, and chain of custody procedures that ensure evidence remains untampered and trustworthy. By the end, you’ll understand how proper acquisition and preservation form the foundation of every successful digital investigation.

涵盖的内容

10个视频1篇阅读材料1个作业1次同伴评审1个讨论话题

10个视频总计44分钟

Module Introduction 2分钟
Types of Acquisition and Image Formats 6分钟
Precautions During Evidence Handling 5分钟
Write Blockers and Imaging Best Practices 3分钟
Disk Imaging with FTK Imager and Analysis in Autopsy 8分钟
Bit-by-Bit Imaging Using DD (Linux CLI) 5分钟
Hashing for Integrity (MD5/SHA1/SHA256) 5分钟
Maintaining Forensic Soundness 3分钟
Chain of Custody: Concept and Importance 3分钟
Labelling and Evidence Bagging Procedures 4分钟

1篇阅读材料总计5分钟

Protecting Digital Evidence Integrity and Preserving Chain of Custody 5分钟

1个作业总计20分钟

Evidence Acquisition and Preservation Using Forensic Tools20分钟

1次同伴评审总计20分钟

Hands-On-Learning: Browser History and Registry Artifact Analysis20分钟

1个讨论话题总计10分钟

Analyzing a USB Drive While Preserving Evidence Integrity10分钟

In this module, you’ll learn how to examine digital media and uncover the traces users and systems leave behind. We’ll break down the essentials of file systems, metadata, and deleted file recovery so you can start identifying meaningful artifacts in real forensic cases. You’ll explore how user activity, system logs, and application traces come together to form a timeline of events that tells the story of what happened on a machine. By the end, you’ll be able to extract key evidence, analyze it with industry tools, and interpret patterns that support a clear forensic narrative.

涵盖的内容

10个视频1篇阅读材料1个作业1次同伴评审1个讨论话题

10个视频总计67分钟

Module Introduction 2分钟
Understanding NTFS, FAT32, and EXT File Systems 6分钟
Metadata: MAC Times (Modified, Accessed, Created) 6分钟
Recovering Hidden, Deleted, or Orphaned Files 6分钟
Prefetch Files and Registry Analysis (Windows) 8分钟
Tracking Document Access and USB Device Usage 10分钟
Interpreting Log Files (Windows Event Logs, Syslog) 8分钟
Timeline Creation Using Autopsy 9分钟
Correlating Data Across Artifacts and Sources 6分钟
Interpreting Anomalies and Suspicious Gaps 7分钟

1篇阅读材料总计5分钟

An Abstraction-Based Approach for Reconstruction of Timeline in Digital Forensics5分钟

1个作业总计20分钟

Performing Basic Forensic Analysis on Digital Media20分钟

1次同伴评审总计20分钟

Hands-On-Learning: Building a Forensic Timeline in Autopsy20分钟

1个讨论话题总计10分钟

Live vs. Dead Acquisition in Digital Forensics10分钟

In this module, you’ll learn how to turn your forensic analysis into a clear, defensible report that can stand up to scrutiny in legal, corporate, or investigative environments. We’ll walk through the essential sections of a professional forensic report, explore how to document evidence accurately, and practice writing in a way that is objective, concise, and easy for non-technical audiences to understand. You’ll also learn how to maintain chain of custody records, prepare screenshots and supporting visuals, and avoid common reporting mistakes that can weaken a case. By the end, you’ll feel confident finalizing and presenting a forensic report that communicates your findings with clarity, credibility, and professionalism.

涵盖的内容

11个视频1篇阅读材料1个作业1次同伴评审1个讨论话题

11个视频总计69分钟

Module Introduction 2分钟
Purpose and Structure of a Forensic Report 5分钟
Required Sections: Executive Summary, Methodology, Findings, Conclusions 6分钟
Writing for Non-Technical Audiences 5分钟
Evidence Storage and Management in a Cloud Environment 7分钟
Completing and Preserving Chain of Custody Forms 13分钟
Anti-Forensic Techniques and Mitigation Strategies 6分钟
Screenshots and Supporting Visual Evidence 6分钟
Writing Clear Conclusions Based on Evidence 6分钟
Case Review and Criticism 4分钟
Ethics and Responsibility in Reporting 7分钟

1篇阅读材料总计5分钟

Technical Reporting in Digital Forensics 5分钟

1个作业总计20分钟

Reporting Digital Evidence and Analysis Findings20分钟

1次同伴评审总计20分钟

Hands-On-Learning: Drafting a Forensic Mini-Report with Screenshots20分钟

1个讨论话题总计10分钟

Recovering and Analyzing Deleted Files10分钟

In this wrap-up module, you’ll apply your full set of digital forensics skills by analyzing a provided disk image in Autopsy. You’ll extract artifacts, interpret activity, and create a clear forensic report that demonstrates your ability to handle a real investigation from start to finish.