Intermediate Computer Forensics builds upon foundational forensic skills to develop deeper investigative capability across storage media, memory, file systems, and user activity artifacts. Students learn to conduct structured forensic investigations involving disk imaging, memory acquisition and analysis, file and partition recovery, artifact correlation, and evidence reporting. The course emphasizes analytical decision-making, evidence correlation across sources, and investigative workflow rather than tool-centric operation alone. Hands-on labs focus heavily on memory forensics using Volatility, advanced file system analysis, and integrated host investigations. Students conclude with a Culmination Exercise (CULEX) requiring full-scope forensic analysis and professional reporting.
Intended Audience: This course is intended for cyber defenders, incident responders, forensic analysts, and investigators who have completed introductory forensic training or possess equivalent experience. Students should already understand basic forensic principles, disk imaging concepts, and file systems.