NEVADA | PROFESSIONAL EXPERIENCE

Program Professional Framework

Digital Forensics

Program Overview

Digital evidence supports investigations into fraud, insider threats, cyber intrusions and misconduct, but it is only useful if collected and handled correctly. This course covers the forensic process from identification and preservation through acquisition, analysis and reporting, with emphasis on chain of custody and guidance such as ISO/IEC 27037 and NIST SP 800-86. Participants work through disk, memory, mobile, email and cloud artefacts, build investigation timelines and draft reports that can withstand legal and disciplinary scrutiny in GCC jurisdictions.

Learning Outcomes

✓Apply a structured forensic process to an incident, from scoping and identification to reporting.
✓Preserve and acquire digital evidence using write-blocking and hash verification while maintaining a documented chain of custody.
✓Analyse file system, registry, browser and log artefacts to reconstruct user and attacker activity.
✓Build an event timeline that correlates evidence across endpoints, email and cloud services.
✓Write a forensic report that presents findings, methods and limitations clearly for legal or disciplinary use.

Target Audience

Incident response and security operations analysts
Fraud and internal investigations specialists
IT auditors and information security officers
Law enforcement and regulatory investigators handling digital evidence

Detailed Program Modules

01Forensic Principles and Process

Types of investigations and evidence sources
Forensic process models and investigation scoping
Legal admissibility and chain of custody

02Evidence Identification and Acquisition

Guidance from ISO/IEC 27037 and NIST SP 800-86
Disk imaging, write blockers and hash verification
Live response and volatile memory capture

03Windows and File System Analysis

File systems, deleted files and file carving
Registry, event logs and user activity artefacts
Browser history and removable media traces

04Memory, Network and Log Forensics

Memory analysis for processes and malware
Network traffic and firewall log analysis
Correlating logs from servers and security tools

05Mobile, Email and Cloud Evidence

Mobile device acquisition approaches and limits
Email header analysis in business email compromise cases
Collecting evidence from cloud and SaaS platforms

06Timelines, Reporting and Testimony

Building and validating super-timelines
Structuring the forensic report
Presenting findings to legal teams, committees and courts

Training Methodology

Interactive expert-led sessions grounded in workplace examples

Case studies and practical exercises drawn from the region

Group workshops with peer review of decisions and deliverables

Formative feedback against clear performance criteria

Applied Project & Assessment

Applied Project

Participants investigate a simulated insider data theft case: they document acquisition with hash values and chain-of-custody forms, analyse provided artefacts, build a timeline of events and submit a forensic report suitable for a disciplinary committee.

Assessment

Short diagnostic at the start, practical tasks linked to each learning outcome, and evaluation of the applied project against published criteria.

University Certificate & International Accreditation

Professional Certificate accredited by Universiti Teknologi Malaysia (UTM) in Digital Forensics

International accreditation: American Association of Innovation (AAI)