Essentials of Evidence handling
RCCE students will learn digital evidence handling procedures including evidence identification, collection, preservation, chain of custody documentation, and evidence integrity verification. RCCE students will learn to follow forensically sound evidence handling procedures, use write blockers and forensic imaging tools, maintain chain of custody documentation throughout investigations, calculate and verify evidence hashes for integrity, securely store and transport digital evidence, prepare evidence packages for legal proceedings, and comply with organizational and jurisdictional evidence handling requirements that ensure admissibility in court. This essentials course covers the core knowledge needed to operate competently in this domain. Starting from foundational concepts, RCCE students will learn the fundamental concepts, terminology, risks, and defenses that form the foundation for all further study and professional practice. Students build a solid knowledge base that prepares them for more advanced courses and real-world security responsibilities.
- Security Engineers building defensive controls
- Security Analysts and Blue Team members
- Systems Administrators with security responsibilities
- GRC and Risk Professionals supporting controls
- Professionals implementing Essentials of Evidence handling
- Execute hands-on tasks for advanced cyber defense mastery
- Execute hands-on tasks for level: beginner
- Execute hands-on tasks for domain: incident
- Execute hands-on tasks for duration: 4 hours
- Explain Executive Overview fundamentals
- Execute hands-on tasks for why it matters — covering Master forensically sound evidence procedures, Evidence mishandling invalidates.
- Execute hands-on tasks for core definitions & terminology
- Execute hands-on tasks for digital evidence
- Execute hands-on tasks for forensic image
- Execute hands-on tasks for computer evidence
- Execute hands-on tasks for mobile evidence
- Execute hands-on tasks for cloud evidence
| Module 01 | Advanced Cyber Defense Mastery |
| Module 02 | Level: Beginner |
| Module 03 | Domain: Incident |
| Module 04 | Duration: 4 Hours |
| Module 05 | Executive Overview |
| Module 06 | Why It Matters |
| Module 07 | Core Definitions & Terminology |
| Module 08 | Digital Evidence |
| Module 09 | Forensic Image |
| Module 10 | Computer Evidence |
| Module 11 | Mobile Evidence |
| Module 12 | Cloud Evidence |
| Module 13 | Evidence Identification Process |
| Module 14 | 1. Scene Assessment |
All hands-on labs run on Rocheston Rose X OS. Students practice essentials of evidence handling by implementing the controls discussed in class, with a focus on real-world deployment, monitoring, and validation.
- Lab 1: Execute hands-on tasks for advanced cyber defense mastery
- Lab 2: Execute hands-on tasks for level: beginner
- Lab 3: Execute hands-on tasks for domain: incident
- Lab 4: Execute hands-on tasks for duration: 4 hours
- Lab 5: Explain Executive Overview fundamentals
Upon successful completion of this course, students will receive an official RCCE Course Completion Certificate for Essentials of Evidence handling, verifiable through the Rocheston certification portal.
- Full access to all course materials and slide decks
- Hands-on lab access on Rocheston Rose X OS environment
- Access to Rocheston CyberNotes
- Access to Rocheston Zelfire — EDR/XDR SIEM platform
- Access to Rocheston Raven — online cyber range exercise platform
- Access to Rocheston Vulnerability Vines AI