Digital Forensics and Incident Investigation
About This Course
This one-day course builds on incident response fundamentals to provide participants with practical, engineering-focused knowledge of digital forensics and forensic-aware containment. The course equips experienced practitioners to correctly identify, preserve, and support forensic investigations through proper log retrieval, artifact handling, and evidence integrity, while formal forensic analysis is conducted by specialized vendors. Participants will gain an understanding of forensic principles, chain-of-custody awareness, and coordination with legal and compliance stakeholders. The course also introduces the role of AI in modern cybersecurity and investigations, highlighting how AI can enhance detection, triage, correlation, and investigative efficiency without compromising forensic rigor.
What You'll Learn
• Understand digital forensics principles, including evidence types, integrity, and chain-of-custody awareness
• Identify and collect relevant forensic artifacts (network, endpoint, cloud, application) without contaminating evidence
• Support containment and recovery actions that preserve forensic value while stabilizing services
• Recognise when to escalate to forensic vendors
• Effectively coordinate with forensic vendors, legal, and compliance teams during investigations
• Understand how AI is applied in cybersecurity and investigations, and its strengths and limitations
Entry Requirements
· General Diploma
· Knowledge of basic cybersecurity acts and cybersecurity concepts