Evidence-grade investigation — OSINT footprinting, disk and memory acquisition, artifact analysis and defensible report writing.
Forensics is not recovery. The question is not only what is on the device, but what happened, when, and whether the answer will hold up when somebody challenges it.
The programme starts with the discipline itself — investigation principles, chain of custody, evidence handling — then works outward through OSINT and footprinting methodology before turning inward to the machine: file system structure and MFT analysis, bit-stream imaging, Windows registry artifacts, and volatile memory captured with Volatility.
Browser history, email headers, packet captures and mobile acquisition round out the sources. The final module is the one that decides whether the work counts: writing an investigative report that traces every conclusion back to a specific artifact.
Send us your background and we will confirm the next batch date, the schedule and what you need to bring.