Syllabus
Introduction to cyber forensic investigation and investigation tools including Autopsy and FTK. Digital evidence collection — chain of custody, hash verification, and artifact prioritization. Evidence preservation using write blockers, forensic imaging, and integrity verification. Data recovery through file carving and pattern recognition for fragmented data. Search and seizure of computers and devices — legal frameworks and best practices. Recovering deleted evidence using undelete tools and data reconstruction techniques. Password cracking — dictionary attacks, brute-force, and rainbow tables.
Hardware and storage device forensics — NAND flash internals and SSD basics. File system forensics covering FAT, NTFS, ext4, and APFS with timeline reconstruction. File System Tunneling — NTFS tunneling behavior and forensic implications. OS forensics for Windows, Linux, and Mac — registry analysis and system artifact investigation. Memory forensics using Volatility — process injection detection and malware classification from memory dumps. Mobile forensics for Android logical acquisition on android emulator, chat and location data correlation. Investigating copiers, IVR, Video surveillance, RFID and Sim cards.
OS forensics across Windows, Linux, Android, and iOS — artifact investigation and timeline analysis. Browser forensics — history, cache, cookies, and session reconstruction. E-Mail forensics — header analysis, phishing detection, and email thread reconstruction. Social media forensics — metadata extraction, fake account and bot detection. LLM and Generative AI forensics — tracing AI-generated content, prompt injection artifacts, and model misuse investigation. Explainable AI (XAI) in forensics — interpreting AI-based forensic decisions for legal admissibility. SOC operations and incident response — SIEM workflows, alert triage, and escalation procedures. Anti-forensics — timestomping, log clearing, and detection of anti-forensic artifacts. Code obfuscation detection techniques.
Network and communication forensics — packet analysis. Steganography and image file forensics — LSB analysis and stego-detection. . Espionage and investigations — APT attribution and threat intelligence platforms. Cloud forensics — AWS collection and cloud log analysis. OSINT using tools such as Maltego and SpiderFoot. Online anonymity and rootkits — dark web forensics and de-anonymization techniques. Threat level assessment — threat scoring and MITRE ATT&CK integration. Evidence remnant detection after overwriting, forging, wiping, and destruction. SOC threat hunting — hypothesis-driven investigation, log correlation, and IOC analysis.
Security standards — ISO 27001, NIST SP 800-61, and ISO/IEC 27037 (digital evidence handling standard). Cyber laws and legal frameworks — IT Act 2000 and its amendments, GDPR, and CCPA. Cyber laws in India — BNSS 2023 (Bharatiya Nagarik Suraksha Sanhita), DPDP Act 2023 (Digital Personal Data Protection), and Section 65B of the Indian Evidence Act. CERT-In guidelines — reporting obligations, incident classification, and compliance requirements. Admissibility of digital evidence — chain of custody, legal standards, and court procedures. Case studies — ransomware investigations, APT incidents, and insider threat analysis.