Free to read · Three levels
Digital Forensics: provenance, interpretation, and reproducible evidence
A complete course in disciplined reasoning about digital artifacts, separating byte integrity, record meaning, uncertainty, and supported conclusions using synthetic material only.
Start learningIn this course
Follow author-created fictional workshop records from a bounded question to a reviewable analytical package. Basic lessons develop scope, byte integrity and provenance, handling and derivation records, encodings and offsets, timestamp semantics, and the distinction between observation and hypothesis.
Intermediate lessons cover row-accounted logs, uncertain timelines, custom signatures and structures, deletion and carving limits, and browser/network artifact models. Advanced lessons develop synthetic filesystem and process models, parser capability validation, scoped correlation, reporting and confidence, and an integrated case review.
English and Arabic provide complete teaching with identical technical examples, identifiers, and outputs. Programs operate on locally created bytes, strings, and dictionaries; planning records remain non-runnable. The course acquires no real evidence, reads no device, memory, account, browser profile, or network traffic, and determines neither legal admissibility nor forensic-tool certification.
What you will learn
- Frame supported questions, scope, and qualifications for digital material.
- Preserve originals, derivations, parsing failures, row accounting, and temporal uncertainty.
- Interpret record, filesystem, process, browser, and network relationships under explicit assumptions.
- Present reproducible findings while separating hypotheses, unresolved attribution, and evidence limits.
Your learning path
Three levels
Basic: scope, integrity, and interpretation
Frame questions, distinguish integrity and provenance, record derivations, and interpret bytes, metadata, and hypotheses.
- Frame a forensic question and its scope
- Separate byte integrity from provenance
- Keep handling and derivation records
- Read bytes, encodings, and offsets precisely
- Interpret metadata and timestamp meaning
- Keep observations, hypotheses, and alternatives distinct
Intermediate: artifact-specific offline analysis
Account for logs and uncertainty, validate custom structures, and interpret synthetic deletion, browser, and network records.
- Normalize logs without losing record accounting
- Build timelines that retain uncertainty
- Check file signatures against declared structure
- Reason about deletion and carving limits
- Interpret browser artifact models cautiously
- Interpret offline network records without contacting targets
Advanced: models, validation, correlation, and reporting
Use filesystem/process models, capability validation, scoped correlation, and reproducible reporting in a complete synthetic package.
- Model filesystem relationships without accessing media
- Reason about memory and process records safely
- Validate analytical methods with known fixtures
- Correlate artifacts without multiplying certainty
- Report findings, confidence, and limitations clearly
- Review a complete synthetic analysis package
Who this is for
- Learners, analysts, and quality engineers who want to interpret digital artifacts without overstating their evidence.
- Reviewers who need to trace findings precisely to inputs, methods, and limitations.
Before you start
- Basic familiarity with files, JSON, logs, and programming functions.
- Ability to read short Python programs; optional validation uses an already available interpreter without package installation.