Easier to read with cream paper, a tint, more contrast or larger text? Choose your colours and text, once, for every page.

Free module

Digital forensics

Learn digital forensics hands on: collect evidence, check it with hashes, rebuild a timeline from logs and write a report, in a real lab.

5 lessons290 min lessonCybersecurity

The lessons

Each lesson is free to read in full. Create a free account to run its commands in a live lab and to sit its quizzes and tasks.

  1. 1 · Virtual machine lab

    How to collect digital evidence

    I can collect digital evidence in a sensible order without changing it.

    Read the lesson

  2. 2 · Virtual machine lab

    Hashes and file metadata

    I can use a hash to prove a file is unchanged and read its metadata.

    Read the lesson

  3. 3 · Virtual machine lab

    Reading logs to build a timeline

    I can rebuild a timeline of events from more than one log.

    Read the lesson

  4. 4 · Virtual machine lab

    Finding suspicious files and processes

    I can find a suspicious file by its place, its owner and its first bytes.

    Read the lesson

  5. 5 · Virtual machine lab

    Writing a digital forensics report

    I can write a report that separates fact, evidence and opinion.

    Read the lesson

Worked in a real lab

Every lesson of this module is worked in a lab started for you alone. The labs it uses:

Teaching a class? Set this module for your students with a teacher guide, marked assignments and a lab for every student.