Basic Computer Forensics introduces foundational concepts and practical skills for collecting, preserving, and analyzing digital evidence from computer systems. Students learn how forensic investigations are conducted, how common attack vectors leave artifacts, and how data is acquired and examined in a forensically sound manner. The course emphasizes disk structure, file systems, deleted data, and core forensic artifacts across Windows and Linux systems. Hands-on labs focus on evidence acquisition, file system analysis, artifact interpretation, and introductory use of forensic tools. Students finish the course with the ability to perform basic forensic analysis and explain findings in a structured manner.
Intended Audience: This course is intended for junior cyber defenders, incident responders, analysts, and technical personnel who require foundational knowledge of computer forensics. No prior forensic experience is required. Familiarity with basic operating system concepts is helpful but not mandatory.