Advanced Evidence handling Mastery: Case Studies
RCCE students will learn digital evidence handling procedures including evidence identification, collection, preservation, chain of custody documentation, and evidence integrity verification. RCCE students will learn to follow forensically sound evidence handling procedures, use write blockers and forensic imaging tools, maintain chain of custody documentation throughout investigations, calculate and verify evidence hashes for integrity, securely store and transport digital evidence, prepare evidence packages for legal proceedings, and comply with organizational and jurisdictional evidence handling requirements that ensure admissibility in court. This advanced mastery course challenges experienced practitioners with complex scenarios, expert-level techniques, and nuanced decision-making. At an expert level, RCCE students will learn to handle the most demanding situations in this domain, developing the expertise expected of senior security professionals. Students tackle multi-layered problems that require synthesizing knowledge across multiple disciplines.
- Security Engineers building defensive controls
- Security Analysts and Blue Team members
- Systems Administrators with security responsibilities
- GRC and Risk Professionals supporting controls
- Professionals implementing Advanced Evidence handling Mastery: Case Studies
- Execute hands-on tasks for advanced evidence
- Execute hands-on tasks for handling mastery
- Build detections and response workflows for privilege escalation
- Explain Course Overview & Learning Objectives fundamentals
- Execute hands-on tasks for course scope
- Execute hands-on tasks for mastery goals — covering Forensically sound evidence handling end-to-end, Identify and classify all digital evidence types.
- Execute hands-on tasks for target audience — covering Senior incident responders and forensic analysts.
- Execute hands-on tasks for digital evidence taxonomy
- Execute hands-on tasks for volatile evidence — covering RAM, CPU cache, running, Non-Volatile Evidence, Hard drives, SSDs, USB media.
- Execute hands-on tasks for non-volatile evidence — covering Hard drives, SSDs, USB media.
- Execute hands-on tasks for network evidence — covering Packet captures, flow records.
- Execute hands-on tasks for log evidence — covering System event logs (Win/Linux).
| Module 01 | Advanced Evidence |
| Module 02 | Handling Mastery |
| Module 03 | Incident Response |
| Module 04 | Course Overview & Learning Objectives |
| Module 05 | Course Scope |
| Module 06 | Mastery Goals |
| Module 07 | Target Audience |
| Module 08 | Digital Evidence Taxonomy |
| Module 09 | Volatile Evidence |
| Module 10 | Non-Volatile Evidence |
| Module 11 | Network Evidence |
| Module 12 | Log Evidence |
| Module 13 | Cloud Evidence |
| Module 14 | Mobile Evidence |
All hands-on labs run on Rocheston Rose X OS. Students practice advanced evidence handling mastery: case studies by implementing the controls discussed in class, with a focus on real-world deployment, monitoring, and validation.
- Lab 1: Execute hands-on tasks for advanced evidence
- Lab 2: Execute hands-on tasks for handling mastery
- Lab 3: Build detections and response workflows for privilege escalation
- Lab 4: Explain Course Overview & Learning Objectives fundamentals
- Lab 5: Execute hands-on tasks for course scope
Upon successful completion of this course, students will receive an official RCCE Course Completion Certificate for Advanced Evidence handling Mastery: Case Studies, verifiable through the Rocheston certification portal.
- Full access to all course materials and slide decks
- Hands-on lab access on Rocheston Rose X OS environment
- Access to Rocheston CyberNotes
- Access to Rocheston Zelfire — EDR/XDR SIEM platform
- Access to Rocheston Raven — online cyber range exercise platform
- Access to Rocheston Vulnerability Vines AI