Module 11: Digital Forensics & Data Recovery
Learn to preserve digital evidence, analyse disk and memory artefacts and understand how deleted data can be recovered. Forensic discipline is what makes findings defensible in an investigation and usable by management or the courts.
- Level
- Advanced
- Study time
- 6 hours
- Lessons
- 5
- Practice labs
- 3
- Assessments
- 2
- Format
- Self-paced, online
What you will learn
By the end of this course you will be able to:
- Preserve evidence, analyse disks and memory, and recover lost data (syllabus outcome for Module 11).
- Verify evidence integrity by comparing hashes and identify gaps in a chain-of-custody record.
- Reconstruct a short timeline from memory and file artefacts and write a structured forensic report.
Before you start
Module 10 recommended; basic Windows file system and process knowledge
Tools you will use
Course outline
5 lessons in 2 modules.
Sub-module 11.1: Digital forensics fundamentals
- Evidence handling, chain of custody and order of volatility
- Imaging, hashing and working on a copy
- Disk and memory analysis concepts
Sub-module 11.2: Data recovery & carving
- Deleted data, recovery and file carving
- Worked example: from timeline to forensic report
Practice labs and assessments
Labs run in the browser as simulations. They never touch a real system.
3 practice labs
- Check the evidence log Beginner, 25 min
- Memory and timeline analysis Intermediate, 35 min
- Investigate and recover Advanced, 45 min, final lab
2 assessments
- Module 11 knowledge check
- Module 11 final quiz
The pass mark is 70%. You can retake an assessment.
Take Module 11: Digital Forensics & Data Recovery
Request access and your instructor will set up your account.