Sign in

OCFI-A | Forensic Foundations & Acquisition

Initialize your investigative methodology. OCFI-A establishes the “Chain of Custody” and the scientific principles of digital evidence. You will master the physics of storage media – from legacy optical drives to modern NVMe SSDs—to understand where data lives and how it hides. The curriculum covers the practical Crime Scene workflow, “Dead Box” disk imaging, and volatile memory capture using the Volatility Framework. This unit validates your ability to acquire forensic images without corrupting the source.

OCFI

Operator Profile

Target Audience

  • Cybersecurity professionals and SOC analysts
  • Digital forensics students and educators
  • Law enforcement and military DFIR teams
  • Penetration testers expanding into forensics
  • IT professionals handling incident response

Objectives

What I will learn?

  • Acquire forensic disk images using tools like FTK Imager, Guymager, and DC3DD
  • Perform live memory analysis using Volatility Framework
  • Recover deleted files and user activity with Autopsy
  • Understand live vs post-mortem acquisition strategies
  • Create bootable forensic USB environments safely
  • Analyze network and DLL artifacts from memory dumps
  • Work with SDR and GNU Radio for radio signal forensics
  • Verify evidence integrity through cryptographic hashing

Recommended PRE-REQUISITE

Requirements

  • Basic understanding of operating systems and networks
  • A Windows or Linux machine for tool installations
  • VirtualBox/VMware (optional for testing in VMs)
  • Internet connection to download tools and datasets

Module Skill level

All Levels

EXCLUSIVE RESOURCES |

DFIR Field Deployment Checklists

Standardized procedural documents for evidence preservation, live response, and post-mortem acquisition workflows.

Volatile Memory Artifact Maps

Technical reference guides for identifying injected DLLs, malicious network beacons, and IOCs within RAM dumps.

Forensic Imaging Workbooks

Structured guides for command-line imaging and evidence extraction using industry-standard write-blocking protocols.

Autopsy Investigation Templates

Pre-configured case modules for Autopsy designed to streamline timeline analysis and automated keyword searching.

EXCLUSIVE RESOURCES |

DFIR Field Deployment Checklists

Standardized procedural documents for evidence preservation, live response, and post-mortem acquisition workflows.

Volatile Memory Artifact Maps

Technical reference guides for identifying injected DLLs, malicious network beacons, and IOCs within RAM dumps.

Forensic Imaging Workbooks

Structured guides for command-line imaging and evidence extraction using industry-standard write-blocking protocols.

Autopsy Investigation Templates

Pre-configured case modules for Autopsy designed to streamline timeline analysis and automated keyword searching.

This module is included in the OCFI certification bundle.

View OCFI program
  • Level
    All Levels
  • Total Enrolled
    8
  • Duration
    25 hours30 minutes
  • Last Updated
    January 28, 2026
  • Certificate
    Certificate of completion

Course Curriculum

Storage Media
In digital forensics, understanding storage media is essential to identifying, acquiring, preserving, and analyzing electronic evidence. This section provides a comprehensive breakdown of common storage technologies that forensic analysts frequently encounter in real-world investigations. From legacy optical drives to modern SSDs, each lecture explores the structure, behavior, and forensic implications of a different storage medium. You’ll learn how data is stored, accessed, and what forensic artifacts can remain—helping you make informed decisions during evidence acquisition and analysis.

  • Storage Media: Optical Drives (CDs/DVDs/Blu-Ray)
    17:30
  • USB Drives and EEPROMs
    06:30
  • SD Cards
    05:00
  • Hard Disk Drives (HDDs)
    10:00
  • Solid State Drives (SSDs)
    09:00

Understanding Computer Systems (For Forensic Investigators)
Before diving deep into forensic imaging, evidence acquisition, or live response, it’s critical to understand how a computer system initializes, boots, and interacts with external devices. This section introduces key system-level knowledge every digital forensic analyst must know—particularly for scenarios involving bootable forensic media and operating system startup. These concepts are essential when dealing with live forensics, incident response, or forensically sound imaging from bootable environments like Kali Linux, CAINE, or Tails.

DFIR Field Guide & Analysis Process (Practical Crime Scene Workflow)
This section introduces you to Digital Forensics and Incident Response (DFIR) from the field perspective—where theory meets practice at crime scenes, corporate breaches, or on-site investigations. You’ll learn what tools and preparations are essential before arriving, and how to choose the right acquisition method based on the system’s state. This knowledge ensures your evidence collection is legally sound, repeatable, and forensically clean—a critical skillset for professionals handling real incidents.

Evidence Acquisition in Digital Forensics
Acquiring digital evidence is a foundational skill in digital forensics, and must be performed with extreme care to preserve data integrity, maintain legal admissibility, and ensure that no contamination occurs. This section introduces you to the most critical tools and techniques used in modern forensic imaging and memory acquisition. Through hands-on demonstrations and real-world scenarios, you’ll learn how to image disks, capture RAM, verify hashes, and use tools like FTK Imager, DC3DD, and Guymager to ensure that the collected data is accurate and defensible in court.

Memory Analysis with Volatility Framework
Memory forensics is a critical component of incident response and malware analysis, revealing volatile evidence that disappears after a reboot. In this section, you’ll master the Volatility Framework, the most widely used open-source tool for memory analysis. You’ll learn how to extract, examine, and interpret RAM dumps—identifying hidden processes, injected DLLs, network connections, and indicators of compromise. These techniques are essential when responding to malware infections, rootkits, or insider threats.

Disk and File System Forensics with Autopsy
In this section, you’ll get hands-on with Autopsy, one of the most widely used GUI-based digital forensics tools for analyzing hard drives, partitions, and file systems. Designed to simplify complex investigations, Autopsy is a go-to platform for forensic examiners performing timeline analysis, keyword searching, deleted file recovery, and evidence extraction. Through guided demonstrations, you'll learn how to install Autopsy, create cases, add evidence, and extract actionable forensic intelligence—perfect for law enforcement, corporate investigators, or academic learners.

149,00 $
  • Level
    All Levels
  • Total Enrolled
    8
  • Duration
    25 hours30 minutes
  • Last Updated
    January 28, 2026
  • Certificate
    Certificate of completion

Want to receive push notifications for all major on-site activities?

✕