Digital Forensics: Collect and Analyze the Evidence

SOC analysts escalate. Forensic analysts answer what actually happened, in a way that holds up when someone checks. This hands-on elective puts you in a university Digital Evidence Unit and walks three referred cases end to end, a found USB drive, a Windows server accessed over a weekend, and a Linux research box, from chain of custody and acquisition through examination, timeline, and a written report an incident responder can act on.

What you will do

• Acquire and verify evidence, and prove it did not change.
• Recover deleted and hidden files, and read the metadata that reveals ownership.
• Examine Windows artifacts (registry, event logs, execution, persistence, file activity) and Linux artifacts (journald, authentication, persistence, ext4 timestamps).
• Analyze a memory capture with Volatility 3.
• Build one timeline from many sources and correlate host evidence with the SIEM.
• Write a defensible forensic report that separates what the evidence shows from what you conclude, and produce an incident-response hand-off package.

Capstone

You work a fourth case alone, from intake to hand-off, graded against a published rubric with an integrity gate: a report that claims more than the evidence supports does not pass.

Certification

This paid elective includes CySA+ exam prep. The course is built so its incident-response and reporting work feels like review on exam day, and the included prep covers the rest. Practice scores are study signals, not predictions.

Where it fits

A SOC Analyst track elective that feeds the Incident Response course. SOC Analyst II is recommended; experienced analysts can start via a placement check.

All scenarios are fictional. Lab pods are isolated with no outbound network access.