Digital evidence reveals the story that suspects would rather keep hidden. In this intensive 8-day course, you’ll learn how to conduct forensic investigations on Windows, macOS, browsers, cloud environments, and video footage, and gather evidence that will hold up in court.
You work for the police, the justice system, or a law enforcement agency, and you need in-depth technical knowledge to collect, analyze, and present digital evidence in a way that will hold up in court.
You handle incidents and want to reconstruct the entire digital attack chain. Forensic investigation gives you the tools to determine exactly what happened—and when, by whom, and through which system.
You are a CISO, sysadmin, or technical specialist and want to develop the forensic skills needed to conduct internal investigations into data breaches, insider threats, or security incidents—and to report your findings in a legally sound manner.
You will learn how to conduct a forensic analysis of the Windows operating system on Windows 10, 11, and Server. You will analyze NTFS file systems, registry hives, Shell Items, LNK files, Shell Bags, and USB devices. You will create live memory images, perform Windows artifact analysis, and use a hex editor for in-depth evidence examination.
You will examine browser history, webmail, Microsoft 365, SharePoint, OneDrive, Teams, and Google Workspace. You will restore deleted registry keys and files, perform data recovery and file carving, and analyze email artifacts from servers and the cloud. You will detect anti-forensic techniques such as file wiping and time manipulation.
You conduct forensic investigations on macOS systems. You analyze system logs, Safari browser history, Keychain data, Time Machine backups, and the Spotlight database. You create Mac memory images and bash history, and examine authentication logs and syslogs.
You will learn to conduct forensic analysis of video evidence: from metadata extraction and authenticity verification to detecting deepfakes and manipulated footage. You will work with DVR/NVR systems, analyze codecs and frames, recover deleted video files, and apply the legal frameworks for video evidence.
You will learn how to conduct forensic searches of the Windows file system and registry. You will analyze NTFS, FAT, and exFAT; work with registry hives, Shell Items, LNK files, and Shell Bags; and examine USB devices, system usage data, and the Windows Search Index. You will create live system and memory images and use a hex editor for evidence analysis. Each student works in their own lab environment.
You will investigate browser artifacts, including private browsing mode; analyze Microsoft 365, SharePoint, OneDrive, and Google Workspace; and recover deleted files and registry keys. You will perform data recovery, string searching, and file carving; analyze email from servers and the cloud; and detect anti-forensic techniques.
You will conduct forensic investigations on macOS systems. You will analyze system logs (system.log, install.log, appfirewall.log), Safari browsing history, Keychain data, Time Machine backups, and the Spotlight database. You will create Mac memory images and analyze bash history, syslogs, and authentication logs. Each student will work in their own lab environment.
You will learn to conduct forensic analysis of video evidence: from metadata extraction and authenticity verification to detecting deepfakes and manipulated footage. You will work with DVR/NVR systems, analyze codecs, frames, and compression artifacts, recover deleted video files, and apply legal frameworks for video evidence, including the chain of custody.
Upon completion, you will have the following demonstrable skills:
Digital evidence doesn't disappear on its own—but without the right knowledge, you won't be able to find it either. After this training, you will.
| Learning Style | Hours | Duration | Days |
|---|---|---|---|
| Consecutive (8 days) | 32 hours | 2 weeks | By mutual agreement |
| Staggered Schedule | 8 hours | 8 weeks | 2–3 half-days per week |
With Finance4Learning, you can easily spread out your investment. The application process is quick, and we’re happy to help you work out what fits your situation. Final approval depends on your personal circumstances.
Many employers cover the full cost of the training. We will provide a detailed proposal.
Open classes for individual employees, or a customized team program. We’ll put together a well-reasoned proposal.
You have a basic understanding of Windows, information security, and TCP/IP networks. You don’t need to be a programmer—but a strong desire to learn is essential. The course is open to investigators, forensic specialists, sysadmins, and CISOs.
Classes are taught in Dutch. The course material, tools, and exams are in English—which is also the standard practice in this field. A solid reading proficiency in English is sufficient to get started. A few times a year, we also offer a class taught entirely in English—please contact us for the dates.
The course consists of 64 academic hours, spread over 8 days. You can choose between a continuous block or a schedule spread out over several 2-day blocks. The exact schedule is negotiable. A fully online option is available upon request.
Yes. The program explicitly focuses on methods for collecting evidence that is admissible in legal proceedings. You’ll learn how to work with the chain of custody, forensically sound imaging, and reporting—so that your findings hold up in court.
This program is not suitable as an entry-level course for those without any IT background. Without a basic understanding of Windows and networking, the technical content will be too advanced too quickly. Not sure if you're ready? Contact us—we'd be happy to help you figure it out.
