This course builds what federal employees need in order to conduct sound digital forensics and incident investigations — not merely to establish that something happened, but to prove what, when, and how, defensibly. It is organized around the NIST SP 800-86 forensic process (Collection, Examination, Analysis, Reporting) and integrates IOC investigation, chain of custody, and the federal legal and oversight framework: the Federal Rules of Evidence, OIG and counsel coordination, ISO/IEC 27037 and 27041-43, and SWGDE. A full capstone investigation closes the course, worked through with the instructor.
Completing it also credits toward the Digital Forensics & Incident Response certificate, which in turn rolls up into the Cyber Operations Professional credential.
Target Audience
Federal SOC and CSIRC analysts, digital forensics examiners, incident response staff, agency ISSOs, OIG technical staff, and any federal employee who may collect, preserve, or analyze digital evidence.
What You'll Learn at a Glance
- Apply the NIST SP 800-86 forensic process and tie it back to the NIST SP 800-61 IR lifecycle.
- Recognize the legal and policy foundations for federal digital evidence, and know the point at which to refer a matter to OIG, counsel, or law enforcement.
- Collect and preserve evidence in order of volatility — memory, disk, network, cloud — without contaminating it.
- Work IOCs across host, network, and behavioral data to establish scope and assemble a timeline.
- Reconstruct timelines and correlate artifacts, with a clear sense of the limits of what forensic evidence can prove.
- Hold a defensible chain of custody and write findings that land with technical, executive, and legal readers.
Course Syllabus
- Module 1
- The Importance of Forensics & Investigation
- Module 2
- Federal Forensic Standards & Legal Foundations
- Module 3
- Forensic Readiness & Evidence Handling
- Module 4
- Evidence Collection & Acquisition
- Module 5
- Indicators of Compromise: Identification & Analysis
- Module 6
- Forensic Analysis Techniques
- Module 7
- Investigation Documentation, Reporting & Chain of Custody
- Module 8
- Best Practices, Quality Assurance & Capstone Investigation (75m)
This course is available for "remote" learning and will be available to anyone with access to an internet device with a microphone (this includes most models of computers, tablets). Classes will take place with a "Live" instructor at the date/times listed below.
Upon registration, the instructor will send along additional information about how to log-on and participate in the class.
