Hands-On Disk forensics
RCCE students will learn disk forensic acquisition and analysis including forensic imaging, file system analysis (NTFS, ext4, APFS, HFS+), deleted file recovery, timeline creation from file system metadata, and artifact extraction. RCCE students will learn to create forensically sound disk images using write blockers and imaging tools, analyze file systems for evidence of attacker activity, recover deleted files and fragments, reconstruct user and attacker activity timelines from file system timestamps, extract browser artifacts, registry hives, prefetch data, and event logs, and produce disk forensics reports that withstand legal scrutiny. This practice-intensive course emphasizes applied skills through lab exercises, real-world scenarios, and production-realistic workflows. At an expert level, RCCE students will learn by doing, building muscle memory and practical confidence through repeated hands-on engagement. Students complete exercises that mirror actual workplace tasks, ensuring skills transfer directly to their professional roles.
- Security Engineers building defensive controls
- Security Analysts and Blue Team members
- Systems Administrators with security responsibilities
- GRC and Risk Professionals supporting controls
- Professionals implementing Hands-On Disk forensics
- Execute hands-on tasks for hands-on disk forensics
- Execute hands-on tasks for forensic acquisition, file system analysis & evidence recovery
- Explain Course Overview & Learning Objectives fundamentals
- Execute hands-on tasks for forensic imaging — covering Create forensically sound disk images.
- Execute hands-on tasks for file system analysis — covering Analyze NTFS, ext4, APFS, HFS+.
- Execute hands-on tasks for data recovery — covering Recover deleted files and fragments.
- Execute hands-on tasks for timeline & reporting — covering Build activity timelines from metadata.
- Explain Disk Forensics Foundations fundamentals
- Execute hands-on tasks for legal framework & evidence admissibility
- Execute hands-on tasks for search authority
- Execute hands-on tasks for seizure protocol
- Execute hands-on tasks for analysis methods
| Module 01 | Hands-On Disk Forensics |
| Module 02 | Forensic Acquisition, File System Analysis & Evidence Recovery |
| Module 03 | Course Overview & Learning Objectives |
| Module 04 | Forensic Imaging |
| Module 05 | File System Analysis |
| Module 06 | Data Recovery |
| Module 07 | Timeline & Reporting |
| Module 08 | Disk Forensics Foundations |
| Module 09 | Legal Framework & Evidence Admissibility |
| Module 10 | Search Authority |
| Module 11 | Seizure Protocol |
| Module 12 | Analysis Methods |
| Module 13 | Daubert Standard |
| Module 14 | Federal Rules of Evidence |
All hands-on labs run on Rocheston Rose X OS. Students practice hands-on disk forensics by implementing the controls discussed in class, with a focus on real-world deployment, monitoring, and validation.
- Lab 1: Execute hands-on tasks for hands-on disk forensics
- Lab 2: Execute hands-on tasks for forensic acquisition, file system analysis & evidence recovery
- Lab 3: Explain Course Overview & Learning Objectives fundamentals
- Lab 4: Execute hands-on tasks for forensic imaging
- Lab 5: Execute hands-on tasks for file system analysis
Upon successful completion of this course, students will receive an official RCCE Course Completion Certificate for Hands-On Disk forensics, verifiable through the Rocheston certification portal.
- Full access to all course materials and slide decks
- Hands-on lab access on Rocheston Rose X OS environment
- Access to Rocheston CyberNotes
- Access to Rocheston Zelfire — EDR/XDR SIEM platform
- Access to Rocheston Raven — online cyber range exercise platform
- Access to Rocheston Vulnerability Vines AI