A digital forensics course and an incident response course, ready to teach
Two complete courses built on the case library: learning outcomes, a grading scheme, the free tools, and a week-by-week plan that names the case, the mode and the time budget. Download the syllabus PDF, then generate every week's lab for your roster in one click from the Courses screen in the app. Every student still gets their own variant; every answer is still verified.
Introduction to Digital Forensics
A 14-week undergraduate course: Windows artifacts, memory, network and mobile evidence, ending in a graded capstone.
Learning outcomes
- Acquire and verify evidence, and keep a chain of custody.
- Recover program execution, file, USB and persistence artifacts from a Windows system.
- Build and defend a timeline from several artifacts.
- Triage memory, network and mobile evidence with free tools.
- Write an investigation report that states findings, cites artifacts and explains method.
Assessment and tools
Weekly labs 50% (best 10 of 12), midterm practical 20%, capstone practical 20%, investigation report 10%.
Autopsy, Registry Explorer, EvtxECmd, PECmd, LECmd, JLECmd, Volatility 3, Wireshark, DB Browser for SQLite, Timesketch. All free.
Prerequisites: Operating systems fundamentals and basic networking. No prior forensics.
| Wk | Topic | Case | Mode | Assessment |
|---|---|---|---|---|
| 1 | Evidence handling and the registry Explain acquisition, hashing and chain of custody. Read USBSTOR and device properties in a SYSTEM hive. | First Look: USB Device History | Practice | Lab 1 |
| 2 | Program execution Interpret Prefetch and UserAssist. Tell a decoy execution from the real one. | First Look: What Ran on This Machine | Practice | Lab 2 |
| 3 | Files the user touched Parse LNK files and jump lists. Recover a target path and its timestamps. | First Look: Recent Files and Jump Lists | Practice | Lab 3 |
| 4 | Persistence Enumerate Run keys and services. Rank persistence mechanisms by stealth. | First Look: What Runs at Startup | Practice | Lab 4 |
| 5 | Windows event logs Read 4720 and 7045 events. Distinguish the acting account from the target account. | First Look: Accounts and Services in the Logs | Practice | Lab 5 |
| 6 | Timelines Normalize timestamps across artifacts. Build and present a super-timeline. | First Look: Building a Timeline | Practice | Lab 6 |
| 7 | Midterm practical Apply weeks 1 to 6 to a full insider-theft case under time. | Insider Data Theft via USB | Timed exam, 75 min | Midterm 20% |
| 8 | Browser and download forensics Trace a download from history to disk. Read browser SQLite stores. | First Look: Suspicious Download | Practice | Lab 7 |
| 9 | Data exfiltration Correlate browser, LNK and email evidence. Prove which file left and when. | The Customer Export | Practice | Lab 8 |
| 10 | Memory forensics Run Volatility 3 process, network and DLL plugins. Identify the suspicious process. | First Look: What's in Memory | Practice | Lab 9 |
| 11 | Code injection in memory Find injected and unlinked modules. Tie a memory finding to disk and network artifacts. | Injected Code in Memory | Practice | Lab 10 |
| 12 | Network forensics Read a PCAP in Wireshark. Extract hosts, sessions and a transferred file. | First Look: Reading a Packet Capture | Practice | Lab 11 |
| 13 | Mobile forensics Query an Android mmssms.db and recover deleted rows from the free space inside its table pages. Convert millisecond Unix timestamps. | The Texts They Deleted | Practice | Lab 12 |
| 14 | Capstone practical and report Work a multi-host intrusion end to end. Deliver an investigation report with chain of custody. | Credential Theft and Lateral Movement | Timed exam, 120 min, with report | Capstone 20% + report 10% |
Incident Response Fundamentals
An 8-week course from reading one EDR alert to running a ransomware incident through every NIST 800-61 phase.
Learning outcomes
- Triage EDR, SIEM and network evidence by severity and ATT&CK technique.
- Scope an intrusion from initial access to impact.
- Choose and justify containment, eradication and recovery actions.
- Produce indicators and a breach report a manager can act on.
Assessment and tools
Weekly labs 50% (best 4 of 5), timed drills 30%, final incident 20%.
Any JSON viewer, jq, Excel or LibreOffice, Wireshark, EvtxECmd, Timeline Explorer. All free.
Prerequisites: Networking and operating systems fundamentals. Introduction to Digital Forensics is helpful but not required.
| Wk | Topic | Case | Mode | Assessment |
|---|---|---|---|---|
| 1 | Reading an EDR alert Triage by severity and read a process tree. Map a detection to an ATT&CK technique. | First Look: Reading an EDR Alert | Practice | Lab 1 |
| 2 | The SIEM queue Read a SIEM alert export. Separate a true positive from noise. | First Look: Reading a SIEM Alert | Practice | Lab 2 |
| 3 | Beacons in web traffic Spot periodic egress in a packet capture. Pull a C2 indicator set. | First Look: One Beacon in the Web Traffic | Practice | Lab 3 |
| 4 | Phishing to foothold Follow a phish through delivery, execution and persistence. Make the first containment call under time. | Phishing to Foothold | Timed exam, 45 min | Drill 1 (15%) |
| 5 | Malware triage Go from alert to verdict with hashes, signatures and behavior. | Malware Triage: From Alert to Verdict | Practice | Lab 4 |
| 6 | Lateral movement Pair 4624 logons with 7045 service installs. Scope which hosts the attacker reached. | Lateral Move to the File Server | Practice | Lab 5 |
| 7 | Business email compromise Trace a fraudulent wire request through mail, browser and phone evidence. Decide what to do first. | Business Email Compromise: Wire Fraud | Timed exam, 45 min | Drill 2 (15%) |
| 8 | Final incident: ransomware Run a live ransomware chain through detection, containment, eradication and recovery. Write the breach report. | Ransomware Before Coffee | Timed exam, 90 min, with report | Final 20% |
Teach the whole term from one download.
Every First Look week in both courses runs free, with no key. The 30-day trial adds weeks 7 and 14 of Introduction to Digital Forensics and week 4 of Incident Response Fundamentals, and an Educator license runs every week.