Browse CTFs New CTF Sign in
Back to Learning Paths
Digital Forensics Analyst
Practitioner Wave 1 Draft

Digital Forensics Analyst

55.0h estimated 3 Courses

This practitioner path teaches the foundations of defensible digital-forensics work. Learners focus on evidence integrity, acquisition concepts, chain of custody, timeline building, artifact interpretation, and professional reporting. The path is designed to help analysts separate facts from hypotheses and produce conclusions that can be reviewed, challenged, and reproduced.

Sign in to enroll

Forensic Principles & Evidence Handling

3 cards

Forensic Principles: Why Process Matters as Much as Technique

forensics_acquisition Difficulty 1–2 40 min

Forensic Imaging: Creating and Verifying an Exact Copy

forensics_acquisition Difficulty 1–2 45 min

NTFS Forensics: The Master File Table & Recovering Deleted Files

forensic_file_artifacts Difficulty 2–3 60 min

Artefact Analysis: File Systems & Memory

5 cards

Windows Registry Forensics: Persistence & User Activity Artefacts

forensic_file_artifacts Difficulty 2–3 55 min

Memory Forensics: What RAM Reveals That Disk Never Shows

memory_forensics Difficulty 2–3 65 min

Windows Event Log Forensics: Building Evidence from Logs

log_analysis_siem Difficulty 2–3 55 min

File Slack & FAT Forensics: Recovering What Should Be Gone

forensic_file_artifacts Difficulty 2–3 55 min

Elective: Browser & Email Forensics — Digital Footprints of User Activity

network_forensics_pcap Difficulty 2–3 55 min

Timeline, Reporting & Capstone Investigation

4 cards

Building a Super-Timeline: Merging All Artefacts into One Story

forensic_timeline Difficulty 1–3 55 min

Document Forensics: Extracting Evidence from Office & PDF Files

forensic_file_artifacts Difficulty 2–3 55 min

Network Forensics: PCAP Analysis for Investigators

network_forensics_pcap Difficulty 1–2 55 min

Writing the Forensic Report: Making Your Findings Hold Up

forensic_timeline Difficulty 1–2 50 min
🏅

CTFFactory Digital Forensics Analyst — Practitioner

Practitioner credential — awarded upon completion