Essentials of Disk forensics
RCCE students will learn disk forensic acquisition and analysis including forensic imaging, file system analysis (NTFS, ext4, APFS, HFS+), deleted file recovery, timeline creation from file system metadata, and artifact extraction. RCCE students will learn to create forensically sound disk images using write blockers and imaging tools, analyze file systems for evidence of attacker activity, recover deleted files and fragments, reconstruct user and attacker activity timelines from file system timestamps, extract browser artifacts, registry hives, prefetch data, and event logs, and produce disk forensics reports that withstand legal scrutiny. This essentials course covers the core knowledge needed to operate competently in this domain. Starting from foundational concepts, RCCE students will learn the fundamental concepts, terminology, risks, and defenses that form the foundation for all further study and professional practice. Students build a solid knowledge base that prepares them for more advanced courses and real-world security responsibilities.
- Security Engineers building defensive controls
- Security Analysts and Blue Team members
- Systems Administrators with security responsibilities
- GRC and Risk Professionals supporting controls
- Professionals implementing Essentials of Disk forensics
- Execute hands-on tasks for forensic imaging — covering Create forensically sound disk images.
- Execute hands-on tasks for file system analysis — covering Analyze NTFS, ext4, APFS, HFS+.
- Execute hands-on tasks for deleted file recovery — covering Recover deleted files and fragments.
- Execute hands-on tasks for timeline & reporting — covering Build activity timelines from timestamps.
- Execute hands-on tasks for what is disk forensics?
- Execute hands-on tasks for civil investigations — covering Employment disputes.
- Execute hands-on tasks for criminal investigations — covering Fraud and financial crime.
- Execute hands-on tasks for digital evidence principles
- Execute hands-on tasks for integrity controls — covering Who handled the evidence.
- Execute hands-on tasks for storage media types — covering Magnetic platters with read/write heads, NAND flash memory cells.
- Execute hands-on tasks for hard disk drives (hdd) — covering Magnetic platters with read/write heads.
- Execute hands-on tasks for solid state drives (ssd) — covering NAND flash memory cells.
| Module 01 | Forensic Imaging |
| Module 02 | File System Analysis |
| Module 03 | Deleted File Recovery |
| Module 04 | Timeline & Reporting |
| Module 05 | What Is Disk Forensics? |
| Module 06 | Civil Investigations |
| Module 07 | Criminal Investigations |
| Module 08 | Digital Evidence Principles |
| Module 09 | Integrity Controls |
| Module 10 | Storage Media Types |
| Module 11 | Hard Disk Drives (HDD) |
| Module 12 | Solid State Drives (SSD) |
| Module 13 | Removable Media |
| Module 14 | Virtual Disks |
All hands-on labs run on Rocheston Rose X OS. Students practice essentials of disk forensics by implementing the controls discussed in class, with a focus on real-world deployment, monitoring, and validation.
- Lab 1: Execute hands-on tasks for forensic imaging
- Lab 2: Execute hands-on tasks for file system analysis
- Lab 3: Execute hands-on tasks for deleted file recovery
- Lab 4: Execute hands-on tasks for timeline & reporting
- Lab 5: Execute hands-on tasks for what is disk forensics?
Upon successful completion of this course, students will receive an official RCCE Course Completion Certificate for Essentials of Disk forensics, verifiable through the Rocheston certification portal.
- Full access to all course materials and slide decks
- Hands-on lab access on Rocheston Rose X OS environment
- Access to Rocheston CyberNotes
- Access to Rocheston Zelfire — EDR/XDR SIEM platform
- Access to Rocheston Raven — online cyber range exercise platform
- Access to Rocheston Vulnerability Vines AI