Advanced Artifact collection Mastery
RCCE students will learn digital forensics acquisition, evidence handling, timeline reconstruction, memory and disk analysis, and forensic reporting. RCCE students will learn to collect and preserve digital evidence following forensically sound procedures, reconstruct attack timelines from multiple artifact sources, perform forensic analysis on endpoints, memory, networks, and cloud environments, and produce investigation reports that withstand legal and regulatory scrutiny. This advanced mastery course challenges experienced practitioners with complex scenarios, expert-level techniques, and nuanced decision-making. At an expert level, RCCE students will learn to handle the most demanding situations in this domain, developing the expertise expected of senior security professionals. Students tackle multi-layered problems that require synthesizing knowledge across multiple disciplines.
- Security Engineers building defensive controls
- Security Analysts and Blue Team members
- Systems Administrators with security responsibilities
- GRC and Risk Professionals supporting controls
- Professionals implementing Advanced Artifact collection Mastery
- Execute hands-on tasks for advanced artifact collection mastery
- Build detections and response workflows for privilege escalation
- Explain Course Overview fundamentals
- Execute hands-on tasks for forensic acquisition
- Execute hands-on tasks for forensic reporting — covering Evidence collection, Multi-source correlation, Legal-grade documentation.
- Execute hands-on tasks for learning outcomes
- Execute hands-on tasks for evidence handling
- Execute hands-on tasks for timeline analysis
- Execute hands-on tasks for endpoint forensics
- Explain Digital Forensics Foundations fundamentals
- Execute hands-on tasks for analysis & reporting — covering Recognize potential, Prevent data.
- Execute hands-on tasks for hash verification
| Module 01 | Advanced Artifact Collection Mastery |
| Module 02 | Digital Forensics & Incident Response |
| Module 03 | Course Overview |
| Module 04 | Forensic Acquisition |
| Module 05 | Forensic Reporting |
| Module 06 | Learning Outcomes |
| Module 07 | Evidence Handling |
| Module 08 | Timeline Analysis |
| Module 09 | Endpoint Forensics |
| Module 10 | Digital Forensics Foundations |
| Module 11 | Analysis & Reporting |
| Module 12 | Hash Verification |
| Module 13 | Documentation Log |
| Module 14 | Forensic Acquisition Methods |
All hands-on labs run on Rocheston Rose X OS. Students practice advanced artifact collection mastery by implementing the controls discussed in class, with a focus on real-world deployment, monitoring, and validation.
- Lab 1: Execute hands-on tasks for advanced artifact collection mastery
- Lab 2: Build detections and response workflows for privilege escalation
- Lab 3: Explain Course Overview fundamentals
- Lab 4: Execute hands-on tasks for forensic acquisition
- Lab 5: Execute hands-on tasks for forensic reporting
Upon successful completion of this course, students will receive an official RCCE Course Completion Certificate for Advanced Artifact collection Mastery, verifiable through the Rocheston certification portal.
- Full access to all course materials and slide decks
- Hands-on lab access on Rocheston Rose X OS environment
- Access to Rocheston CyberNotes
- Access to Rocheston Zelfire — EDR/XDR SIEM platform
- Access to Rocheston Raven — online cyber range exercise platform
- Access to Rocheston Vulnerability Vines AI