ForensicSpot7 modules
Digital Forensics
From the order of volatility to chip-off acquisition: the working syllabus end to end, with the Indian statutory frame (IT Act 2000, BNS 2023, BSA 2023 Section 63) woven through.
- 108hours
- 36topics
- 7modules
Module 115 hrs5 topics
Foundations: Hardware, OS & Indian Cyber Law
How modern computers store data, how operating systems boot and lay out files, the cyber crime taxonomy a digital forensic examiner needs, and the Indian statutory frame: IT Act 2000, BNS 2023 cyber sections, BSA 2023 Section 63.
Start module- Computer Hardware Fundamentals for Forensic ExaminersMotherboard to NVMe SSD, register-level volatility to TRIM destruction, mapped onto IT Act 2000, BSA 2023 Section 63.14 min
- Operating Systems, Boot Process and File SystemsUEFI to MFT to APFS snapshots, MAC timestamps, file slack and shadow copies, mapped to BSA 2023 Section 63 admissibility.15 min
- Cyber Crime Taxonomy and the IT Act 2000The Indian cyber crime taxonomy maps onto the IT Act 2000, the ITAA 2008 amendment, and the post-Shreya Singhal legal frame.10 min
- BNS 2023 Cyber Provisions and BSA 2023 Electronic EvidenceBNS 2023 cyber sections and BSA 2023 Section 63 frame electronic evidence in Indian trials, per Anvar PV and Arjun Pandit Rao Khotkar.10 min
- The Digital First Responder: Order of Volatility, Seizure and ImagingA digital first responder follows RFC 3227 order of volatility, RAM capture, write blockers, and dd/E01/AFF4 imaging with dual hashing.14 min
Module 218 hrs5 topics
Computer Forensics: OS Artifacts & Data Recovery
Windows, Linux and macOS artifact-level forensics: registry, event logs, prefetch, ShellBags, ADS, plist, Keychain, Time Machine; plus file carving and recovery from formatted, hidden and encrypted storage.
Start module- Windows Forensic Artifacts I: Registry, Event Logs and PrefetchRegistry hives, EVTX event logs, and Prefetch prove execution, examined with the Eric Zimmerman toolset in the Indian SFSL triage workflow.17 min
- Windows Forensic Artifacts II: ShellBags, ADS, LNK, Hibernation and Slack SpaceShellBags, NTFS Alternate Data Streams, LNK shortcuts, hiberfil.sys, pagefile, slack space, VSS and Recycle Bin internals for Indian digital forensic examiners.11 min
- Linux Forensic Artifacts: File System, Logs, Cron and Shell HistoryLinux examiners work ext4, /var/log, auditd, journalctl, bash history, cron persistence, SUID, SELinux, and plaso timelining.15 min
- macOS Forensic Artifacts: plist, Keychain, Time Machine and Browser TracesmacOS artefacts include APFS, launchd, plist parsing, Keychain, Time Machine snapshots, the Unified Log, FSEvents, and browser traces.15 min
- Data Recovery, File Carving and Recovering Deleted, Hidden & Encrypted ContentRecovering deleted, hidden, and encrypted data spans signature carving, SSD TRIM realities, BitLocker/FileVault/LUKS/VeraCrypt paths, and steganography.14 min
Module 312 hrs4 topics
Internet, Email & Surveillance Forensics
Web browser artifact recovery, email header tracing and spoofed-mail investigation, DVR/NVR surveillance forensics, and how virtual machines and cloud-backed endpoints change the examiner's playbook.
Start module- Web Browser Forensics: Cookies, Cache, History and Session RecoveryChrome, Firefox, Safari, and Edge each keep history, cookies, cache, and credentials differently, including recoverable incognito traces.14 min
- Email Forensics: Protocols, Header Tracing and Spoofed Mail InvestigationEmail forensics traces SMTP/POP3/IMAP headers, SPF/DKIM/DMARC checks, and PST/OST/mbox parsing to investigate phishing and spoofed mail.14 min
- DVR/NVR and Surveillance System ForensicsIndian cyber cells acquire DVR/NVR evidence from proprietary file systems and H.264/H.265 frames, under BSA 2023 Section 63.15 min
- Virtual Machine and Cloud-Backed Endpoint ForensicsVM and cloud-endpoint forensics covers VMDK/VHDX/qcow2 snapshot chains, OneDrive and iCloud placeholders, and Docker overlay2 evidence.17 min
Module 418 hrs6 topics
Network Forensics
Networking fundamentals to live capture: OSI/TCP-IP, network attack taxonomy, wireless attacks across WEP/WPA/WPA2/WPA3, defence architecture, packet capture and DPI, and malware static + dynamic analysis.
Start module- Computer Networking Fundamentals: OSI, TCP/IP, IPv4/IPv6 and SubnettingNetworking fundamentals for examiners span OSI vs TCP/IP, IPv4/IPv6 addressing, MAC and routing, and which header fields survive a packet capture.16 min
- Network Attacks: Sniffing, ARP Poisoning, MITM, DDoS, XSS and SQLiThe network attack taxonomy spans sniffing, ARP/DNS spoofing, MITM, DDoS, and OWASP Top 10 web attacks, escalated through CERT-In and I4C.18 min
- Wireless Network Attacks: WEP, WPA, WPA2, WPA3 and Rogue Access PointsWireless attacks span WEP RC4 cracking, WPA2 PMKID and KRACK, WPA3 Dragonblood, evil-twin phishing, and IMSI catchers.14 min
- Network Security Architecture: Firewalls, IDS/IPS, IPSec, SSL/TLS, VPN, PKI and SIEMNetwork security architecture spans firewalls, Snort/Suricata IDS, IPSec, TLS 1.2/1.3, VPNs, PKI, and SIEM under the CERT-In 2022 Direction.16 min
- Live Packet Capture, Traffic Analysis and Deep Packet InspectionLive traffic analysis spans promiscuous capture, BPF filters, NetFlow, and JA3/JA3S fingerprinting, within the CERT-In reporting clock.17 min
- Malware Forensics: Static, Dynamic, Sandbox and Memory AnalysisMalware forensics spans PE headers, YARA, sandboxing, and memory analysis with Volatility 3, illustrated by the AIIMS Delhi ransomware incident.16 min
Module 512 hrs4 topics
Cloud Forensics & Anti-Forensics
Cloud technology, virtualization and the multi-tenant problem; cloud forensics challenges across IaaS/PaaS/SaaS; logging, VM snapshot acquisition and incident response; plus anti-forensic techniques and the counter-moves.
Start module- Cloud Technology, Virtualization and Cloud Security ArchitectureCloud architecture spans NIST SP 800-145's IaaS/PaaS/SaaS model, hypervisors, IAM, and KMS, framed by India's DPDP Act and RBI localisation rules.17 min
- Cloud Forensics: Multi-Tenant, API and Jurisdictional ChallengesCloud forensics under NIST IR 8006 covers multi-tenancy, API evidence, and snapshot acquisition, within India's DPDP Act and MLAT process.17 min
- Cloud Logging, VM Snapshots and Cloud Incident ResponseCloud incident response spans AWS/Azure/GCP logging and snapshot acquisition under NIST 800-61 and CERT-In's 180-day retention rule.14 min
- Anti-Forensic Techniques and Investigator Counter-MethodsAnti-forensic techniques span data destruction, steganography, timestomping, and encrypted containers, countered under BNSS Section 91.14 min
Module 618 hrs6 topics
Mobile, Wireless & IoT Forensics
Mobile network generations and SIM/IMEI fundamentals, Android and iOS forensics with SQLite, wireless and mobile network attacks, the acquisition stack from logical to chip-off, mobile cloud backups and IoT device forensics.
Start module- Mobile Technologies: 2G to 5G, GSM/CDMA, SIM and IMEICellular generations, GSM and CDMA architecture, SIM file system, IMEI structure and Indian SIM-swap and CEIR workflows.12 min
- Mobile Operating Systems: Android, iOS, SQLite and App ForensicsAndroid and iOS architecture, SQLite WAL recovery, per-app artefact paths, UPI app forensics and encryption models for Indian digital forensic examiners.14 min
- Wireless and Mobile Network Attacks: Phreaking, SIM Swap, NFC and QRMobile network attacks span phone phreaking history, IMSI catchers, SIM swap fraud, NFC cloning, and QRJacking against UPI.19 min
- Mobile Phone Forensics: Acquisition Methods, JTAG, Chip-Off and ToolkitsMobile acquisition follows the NIST SP 800-101 R1 extraction ladder from manual through JTAG and chip-off, using Cellebrite UFED and Magnet AXIOM.21 min
- Mobile Cloud and Backup Forensics: iCloud, Google Drive and App PermissionsMobile cloud forensics covers iCloud and Google backups, WhatsApp E2E backups, and TCC.db, obtained via BNSS 91 orders or MLAT.18 min
- IoT Forensics: Smart Home, Wearables, MQTT/CoAP and Firmware AnalysisIoT forensics spans smart speakers and wearables, MQTT/CoAP protocols, firmware analysis with binwalk and Ghidra, and UART/JTAG acquisition.17 min
Module 715 hrs6 topics
Social Media Forensics & Cryptography
Social media crime taxonomy and evidence collection across APIs and OSINT, plus the cryptography a digital forensic examiner must understand: symmetric and asymmetric systems, hashing, PKI, digital signatures, cryptanalysis and Diffie-Hellman.
Start module- Social Media Crime: Cyberbullying, Grooming, Stalking and Fake AccountsSocial media crime spans cyberbullying, grooming, stalking, and deepfakes, prosecuted under the IT Act, BNS, POCSO, and Intermediary Guidelines 2021.11 min
- Social Media Evidence Collection: API, Direct, Indirect and OSINTSocial media evidence collection spans direct, API-based, and OSINT methods, with authentication at trial under BSA Section 63.13 min
- Cryptography Fundamentals: Symmetric vs Asymmetric, Substitution and TranspositionCryptography fundamentals cover symmetric and asymmetric trade-offs, classical ciphers, and how CCA India and UPI apply these ideas.15 min
- Symmetric Cryptosystems: DES, AES, RC4 and BlowfishSymmetric cryptosystems span DES through AES, RC4, Blowfish, and ChaCha20-Poly1305, with Aadhaar and UPI mapped onto AES-256.15 min
- Asymmetric Cryptosystems, Hashing, PKI and Digital SignaturesRSA, ECC, SHA-2/3, HMAC, X.509 and the Indian CCA PKI stack with Class 3 DSC and UPI cryptography.13 min
- Cryptanalysis, Cryptographic Attacks and Diffie-Hellman Key ExchangeClassical and modern cryptanalysis, side channels, padding oracles, post-quantum readiness and the Diffie-Hellman key exchange.14 min