Computer Forensic Investigation and Evidence Handling for Cyber Incidents

Course overview

Ransomware, data breaches, business email compromise and insider attacks now hit banks, government agencies and companies across the region. Responding well means more than restoring systems: someone must find out what happened, preserve the evidence and support legal action. This computer forensic investigation course trains investigators and security staff to investigate cyber incidents forensically.

The first week covers the investigation process and core evidence sources: incident response and forensic readiness, legal requirements, evidence handling, operating system and memory forensics, and log analysis across servers, firewalls and directory services. The second week addresses specialised areas: network forensics and traffic analysis, email and business email compromise investigations, web and database attacks, cloud environments, malware triage, anti-forensics techniques, and reporting and expert testimony. A multi-stage incident scenario runs through both weeks, with participants working on laptops using open-source and commercial tools.

Participants leave able to investigate cyber incidents forensically and to produce evidence that supports disciplinary, civil or criminal action.

What you will be able to do

• Apply a forensic investigation process to cyber incidents
• Preserve and handle cyber incident evidence lawfully
• Analyse memory, operating system and log evidence
• Investigate network traffic and intrusions
• Investigate email compromise and web or database attacks
• Collect and analyse evidence from cloud environments
• Triage malware and recognise anti-forensic techniques
• Write forensic reports and give expert evidence

Who should attend

For investigators, security analysts and ICT staff who respond to or investigate cyber incidents. Participants must bring a laptop and be comfortable with basic networking concepts.

• Cybercrime investigators
• Security operations analysts
• Incident responders
• ICT security officers
• Digital forensics examiners
• Bank and fintech security teams
• Internal audit IT specialists

Course outline

Week 1

Week 2

Fees are per participant in US dollars and cover tuition, course materials and your certificate. Travel and accommodation are not included.