ForensicSpot10 modules
Cyber Forensics
The investigation of cybercrime: attack anatomy, malware, web and email tracing, the dark web and cryptocurrency, threat intelligence, and cyber law.
- 60hours
- 30topics
- 10modules
Module 16 hrs3 topics
Cybercrime and Cyber Forensics Foundations
What cyber forensics is and how it differs from device-level digital forensics.
Start module- What Is Cyber ForensicsCyber forensics collects, preserves, and analyses digital evidence from networked environments to support criminal and civil investigations.13 min
- Cyber Forensics vs Digital Forensics: Scope and BoundariesDigital forensics focuses on disk imaging and OS artefacts, while cyber forensics centres on network evidence, online accounts, and cybercrime workflows.13 min
- Legal and Ethical Foundations of Cyber InvestigationsCyber investigators must operate within legal authority, respect privacy rights, and hold chain of custody across multiple jurisdictions.13 min
Module 26 hrs3 topics
Cybercrime Typology
Hacking, fraud, ransomware, identity theft, and online exploitation.
Start module- Hacking and Unauthorised Access OffencesUnauthorised access offences range from opportunistic intrusions to nation-state espionage, each leaving a distinct digital footprint investigators can trace.13 min
- Online Fraud and Financial CybercrimePhishing, business email compromise, card-not-present fraud, and investment scams cause hundreds of billions in annual losses worldwide.13 min
- Ransomware, Identity Theft and Online ExploitationRansomware, identity theft, and image-based sexual abuse combine technical intrusion with human harm, each with its own legal framework.13 min
Module 36 hrs3 topics
Networks and the Internet for Investigators
How the internet works, IP addressing, DNS and attribution basics.
Start module- IP Addressing and Routing Fundamentals for InvestigatorsIPv4 and IPv6 addressing, subnetting, and routing let investigators trace network traffic's origin and attribute communications to physical locations.13 min
- DNS and Domain InvestigationDNS is both an investigative resource and an adversary tool; this topic covers record types, WHOIS and passive-DNS querying, and attacker abuse patterns.13 min
- Network Protocols and Traffic InterpretationReading packet captures or logs requires understanding TCP/IP, HTTP, and SMTP to spot anomalous behaviour and extract evidence from header fields and timing.13 min
Module 46 hrs3 topics
Anatomy of a Cyber Attack
The attack lifecycle, common techniques, and indicators of compromise.
Start module- The Cyber Attack LifecycleThe Unified Kill Chain and MITRE ATT&CK model intrusions as phases from reconnaissance through impact, each creating its own investigative opportunity.13 min
- Common Attack Techniques and Tactics, Techniques and ProceduresSpear-phishing, exploiting public-facing applications, credential dumping, and lateral movement form attackers' repeatable toolkit, documented as TTPs.13 min
- Indicators of Compromise: Identification and UseIndicators of compromise, malicious IPs, file hashes, registry keys, and domains, signal a breach; this topic covers finding and sharing them.13 min
Module 56 hrs3 topics
Malware Analysis Basics
Types of malware and an introduction to static and dynamic analysis.
Start module- Malware Taxonomy: Viruses, Trojans, Ransomware and MoreMalware is classified by propagation mechanism, payload behaviour, and persistence strategy, each category leaving different artefacts on infected systems.13 min
- Static Malware AnalysisStatic analysis characterises a malware sample without running it, using file-type identification, string extraction, hashing, and disassembly.13 min
- Dynamic Malware Analysis and Sandbox EnvironmentsDynamic analysis runs malware in a sandbox to observe its network callbacks, file-system changes, and process activity, with limits on interpreting the results.13 min
Module 66 hrs3 topics
Web, Email and Social Media Investigation
Tracing online accounts, emails, headers and open-source evidence.
Start module- Email Header Analysis and Sender TracingEmail headers encode a relay path investigators use to trace originating servers and spoofing; this topic covers parsing SPF, DKIM, and DMARC results.13 min
- Online Account and Social Media InvestigationSocial media platforms hold content, metadata, and account-linkage signals critical to identifying suspects and building timelines.13 min
- Web OSINT and Digital Footprint AnalysisOpen-source intelligence from websites, cached pages, and image metadata can reveal identities and locations without special legal authority.13 min
Module 76 hrs3 topics
The Dark Web and Cryptocurrency
Anonymity networks, marketplaces, and tracing cryptocurrency transactions.
Start module- Tor and Anonymity NetworksTor, I2P, and similar overlay networks route traffic through encrypted relays to conceal IP addresses from investigators.13 min
- Dark Web Marketplaces and Criminal InfrastructureDark web markets have traded drugs, weapons, stolen data, and malware since the Silk Road era, with operational-security failures driving most takedowns.13 min
- Cryptocurrency Tracing and Blockchain AnalysisCryptocurrency transactions are pseudonymous, not anonymous; public ledgers let investigators trace fund flows and link wallets to identities.13 min
Module 86 hrs3 topics
Cyber Threat Intelligence
Sources, indicators, attribution and how intelligence supports investigation.
Start module- Threat Intelligence FundamentalsCyber threat intelligence turns raw adversary data into actionable knowledge across strategic, operational, tactical, and technical levels.13 min
- Intelligence Sources, Feeds and Sharing PlatformsThreat intelligence comes from open-source feeds, commercial platforms, ISACs, and inter-agency networks, exchanged through the STIX/TAXII standards.13 min
- Attribution in Cyber InvestigationsAttributing an attack to an actor combines technical indicators with behavioural intelligence, covered here with the confidence-level model.13 min
Module 96 hrs3 topics
Cyber Law and Jurisdiction
Computer-crime statutes, cross-border evidence, and lawful access.
Start module- Computer Crime Statutes and Global Legal FrameworksComputer-crime law varies by jurisdiction, though the Budapest Convention on Cybercrime gives over 60 countries a common reference framework.13 min
- Cross-Border Evidence and Mutual Legal AssistanceCybercrime evidence often spans countries, making mutual legal assistance treaties and emergency preservation requests essential investigative tools.13 min
- Lawful Access, Interception Law and Privacy ProtectionsReal-time interception and stored-data requests must navigate lawful-access regimes balancing investigative need against constitutional protections.13 min
Module 106 hrs3 topics
The Cyber Investigation Process
From report to evidence to report, end to end.
Start module- Intake, Scoping and Evidence PreservationThe first actions after a cybercrime report decide whether evidence survives; this topic covers triage, preservation orders, and volatile-data capture.13 min
- Cyber Investigation Tools and Analytical WorkflowA structured workflow, from log ingestion through hypothesis testing, keeps findings reproducible using SIEM and network forensics tools.13 min
- Cyber Investigation Reporting and Court PresentationA cyber investigation ends in an expert report translating technical findings for judges and juries, with testimony standards covered here.13 min