Evidence handling Hardening Clinic
RCCE students will learn digital evidence handling procedures including evidence identification, collection, preservation, chain of custody documentation, and evidence integrity verification. RCCE students will learn to follow forensically sound evidence handling procedures, use write blockers and forensic imaging tools, maintain chain of custody documentation throughout investigations, calculate and verify evidence hashes for integrity, securely store and transport digital evidence, prepare evidence packages for legal proceedings, and comply with organizational and jurisdictional evidence handling requirements that ensure admissibility in court. This hands-on hardening course focuses on reducing attack surface through practical configuration changes and security guardrails. At an expert level, RCCE students will learn to apply hardening baselines, validate configurations, and measure the security improvement achieved. Students walk away with actionable hardening checklists and the skills to maintain hardened configurations as environments evolve.
- Security Engineers building defensive controls
- Security Analysts and Blue Team members
- Systems Administrators with security responsibilities
- GRC and Risk Professionals supporting controls
- Professionals implementing Evidence handling Hardening Clinic
- Execute hands-on tasks for evidence handling hardening clinic
- Explain Course Overview fundamentals
- Execute hands-on tasks for learning objectives
- Execute hands-on tasks for key deliverables — covering 7 hours of hands-on instruction.
- Build detections and response workflows for privilege escalation, including Evidence handling checklist.
- Execute hands-on tasks for digital evidence fundamentals
- Execute hands-on tasks for evidence properties
- Execute hands-on tasks for evidence categories — covering Data stored on electronic.
- Execute hands-on tasks for seconds–minutes
- Execute hands-on tasks for evidence identification process
- Execute hands-on tasks for source discovery
- Execute hands-on tasks for prioritization criteria — covering Enumerate all affected systems, Volatility level (collect most volatile.
| Module 01 | Evidence Handling Hardening Clinic |
| Module 02 | Course Overview |
| Module 03 | Learning Objectives |
| Module 04 | Key Deliverables |
| Module 05 | Mapped to Incident Response domain |
| Module 06 | Digital Evidence Fundamentals |
| Module 07 | Evidence Properties |
| Module 08 | Evidence Categories |
| Module 09 | Seconds–Minutes |
| Module 10 | Evidence Identification Process |
| Module 11 | Source Discovery |
| Module 12 | Prioritization Criteria |
| Module 13 | List mobile and IoT devices |
| Module 14 | Key Principle |
All hands-on labs run on Rocheston Rose X OS. Students practice evidence handling hardening clinic by implementing the controls discussed in class, with a focus on real-world deployment, monitoring, and validation.
- Lab 1: Execute hands-on tasks for evidence handling hardening clinic
- Lab 2: Explain Course Overview fundamentals
- Lab 3: Execute hands-on tasks for learning objectives
- Lab 4: Execute hands-on tasks for key deliverables
- Lab 5: Build detections and response workflows for privilege escalation
Upon successful completion of this course, students will receive an official RCCE Course Completion Certificate for Evidence handling Hardening Clinic, verifiable through the Rocheston certification portal.
- Full access to all course materials and slide decks
- Hands-on lab access on Rocheston Rose X OS environment
- Access to Rocheston CyberNotes
- Access to Rocheston Zelfire — EDR/XDR SIEM platform
- Access to Rocheston Raven — online cyber range exercise platform
- Access to Rocheston Vulnerability Vines AI