NextGen Forensic · Learning platform
NextGen Forensic
Log inSign up

Online certification · Digital forensics & incident response

Digital Forensics

Investigate. Preserve. Analyse.

Learn how digital evidence is collected, preserved, analysed and presented using industry-relevant tools and techniques.

Instructor: NextGen Forensic Faculty

1 month100% onlineLive + recorded sessionsHands-on toolsCase studiesCertification on completion

₹999₹1,999Save 50%

View curriculum

Limited-time offer: ₹999 instead of ₹1,999.

Digital Forensics programme poster
1 month
Duration
100%
Online
10
Modules
14
Core tools
3
Free practice labs

What you’ll learn

Topics covered

  • 01Computer & Storage Forensics
  • 02Mobile Device Forensics
  • 03Network & Internet Forensics
  • 04Email & Social Media Investigations
  • 05Malware & Incident Analysis
  • 06Data Recovery & Analysis
  • 07Report Writing & Legal Aspects
  • 08Hands-on Tools & Case Studies
  • 09Real-world Applications

Overview

About this programme

Almost every investigation today has a digital trail. This programme teaches you to find, preserve and interpret it, following the same investigative process used in digital forensics and incident response work. You move from the foundations of digital evidence and imaging through Windows, Linux, macOS and cloud artifacts, into memory, network and mobile forensics and malware triage, and finish with anti-forensics detection, report writing and expert testimony. Practice continues after class on free online labs such as TryHackMe, HackTheBox and LetsDefend.

Outcomes

What you’ll be able to do

  1. 01Identify digital evidence across storage, memory, network, cloud and mobile, and preserve it in order of volatility.
  2. 02Acquire and verify forensic images and memory captures with hashing and chain of custody.
  3. 03Analyse file systems, recover deleted files and interpret timestamps, including timestomping.
  4. 04Reconstruct user activity from Windows, Linux, macOS and cloud artifacts.
  5. 05Investigate memory, network traffic and mobile devices, and triage malware and ransomware safely.
  6. 06Detect anti-forensics, validate tools and write a report that states findings and limitations.

Who it’s for

Built for four kinds of learner

Forensic science & IT students

Build job-relevant DFIR skills on top of your degree.

Cyber security aspirants

Add the investigation and incident-response side to your security skills.

Law students & legal teams

Understand how electronic evidence is collected, analysed and presented.

IT & SOC professionals

Respond to incidents with a defensible, evidence-first process.

Tools

The tools you’ll learn to use

A

Autopsy

Open-source GUI platform for disk, file, and case analysis

FI

FTK Imager

Forensic disk and memory imaging & preview tool

SK

Sleuth Kit

Command-line engine for file system and disk analysis

C

CyberChef

Browser-based tool for hashing, encoding, and data decoding

E

ExifTool

Extracts and reads metadata from files

MD

Magnet DumpIt

Free Windows RAM/memory acquisition tool

WBT

Windows built-in tools

Native OS utilities used for artifact review

W

Wireshark

Network packet capture and traffic analysis

N

Nmap

Network scanning and host/service discovery

BS

Burp Suite

Web application security testing and proxy tool

M

Metasploit

Penetration testing and exploitation framework

V

VirusTotal

Online multi-engine file/malware scanning

G

Ghidra

Software reverse engineering and disassembly tool

P

PEStudio

Static analysis of Windows executable files

Curriculum

10 modules

01Foundations & the Investigative Process+

What counts as digital evidence (storage, memory, network, cloud, mobile) · the DFIR process: identify, preserve, collect, examine, analyze, report · order of volatility · hashing & integrity (MD5/SHA-1/SHA-256) · write-blocking & chain of custody · timestamps and time zones.

02Evidence Acquisition & Imaging+

Physical vs logical acquisition · image formats (raw/E01/AFF4) · live acquisition & memory capture · triage vs full imaging · verification & hashing during acquisition · cloud and account acquisition.

03File Systems & Disk Analysis+

Partition schemes (MBR/GPT) · NTFS, FAT/exFAT, ext4/APFS basics · slack space, unallocated space & file carving · timestamps and timestomping · deleted-file recovery · encryption at rest (BitLocker/LUKS/FileVault).

04Windows Artifact Analysis+

Registry hives · USB & device history · execution evidence (Prefetch, Amcache, ShimCache) · file/folder access (Shellbags, LNK, Jump Lists) · Windows Event Logs · browser artifacts & persistence locations.

05Linux, macOS & Cloud Artifacts+

Linux logs, shell history, cron & persistence · macOS artifacts (plists, unified log, FSEvents) · cloud shared-responsibility model · AWS CloudTrail, S3 logs, VPC Flow Logs · container & email artifacts.

06Memory Forensics+

What lives only in RAM · process analysis & hidden processes · code injection (DLL injection, hollowing) · network connections recovered from memory · credential/key recovery · fileless malware.

07Network Forensics+

TCP/IP model for investigators · reading PCAP & following streams · protocol analysis (HTTP, DNS, SMB, SMTP) · TLS/encrypted traffic basics · beaconing & C2 detection · DNS as an evidence source.

08Mobile Device Forensics+

Acquisition tiers (manual/logical/file system/physical) · Android internals & ADB · iOS internals & backups · mobile encryption · application artifacts · cell site data & device identifiers.

09Malware & Ransomware Triage+

Safe handling & isolated analysis · static triage (hashes, imports, strings, entropy) · behavioral/dynamic analysis · basic detection rule writing · ransomware specifics · document/script-based malware.

10Anti-Forensics, Reporting & Expert Testimony+

Anti-forensic techniques (wiping, timestomping, log clearing) · detecting anti-forensics · tool validation · structuring a forensic report · stating limitations · expert testimony & Indian electronic evidence basics.

Certification

Earn a certificate you can prove

NextGen Forensic · Certification

CERTIFICATE OF COMPLETION

This certifies that

[ Your name ]

Digital Forensics

VERIFIED

To be certified you must:

  • ✓ Attend the live sessions and complete the module exercises.
  • ✓ Pass the module quizzes.
  • ✓ Complete all lessons in your dashboard.

Every certificate carries a unique ID that anyone can check on our verification page.

Our programmes provide professional skills certification. They build and evidence examination ability and are not, by themselves, a licence, registration, or appointment to serve as a court-recognised expert witness.

The experience

How the programme runs

  1. 01

    100% online

    Live interactive sessions with demonstrations and doubt-clearing, all from home.

  2. 02

    Practical exercises

    Every module ends with a hands-on exercise, so skill is built by doing, not only by listening.

  3. 03

    Session recordings

    Missed a class or want to revise? Recordings are added to your dashboard after each session.

  4. 04

    Free online labs

    Keep practising between sessions on TryHackMe, HackTheBox and LetsDefend.

  5. 05

    Community & doubts

    A private batch group plus the NextGen community for questions, case discussion and peer learning.

  6. 06

    Assessments

    Short quizzes and practical tasks check your understanding module by module.

  7. 07

    Certification on completion

    Complete the programme to earn a certificate with an ID anyone can verify online.

Enrolment

One programme. One clear price.

Batch from 1 Oct 2026

Digital Forensics

The complete 1 month live programme

₹999₹1,999Save 50%

  • ›All 10 modules, taught live
  • ›100% online
  • ›Practical exercises
  • ›Session recordings
  • ›Free online labs
  • ›Community & doubts
  • ›Assessments
  • ›Certification on completion

Institutions & batches

For colleges, departments and teams enrolling a group together.

Custom

  • ›Group enrolment at institutional rates
  • ›Dedicated batch scheduling
  • ›Progress reporting for faculty
  • ›Optional co-branded certificates
Talk to us about a batch

Next batch

Cohort details

Starts
1 Oct 2026
Schedule
Timings shared before the batch starts
Duration
1 month
Format
100% online · live & recorded sessions

Questions

Frequently asked

Do I need a prior forensic background?+

No. The programme starts from first principles. A general interest in forensic science, law or investigation is enough.

Are the classes live or recorded?+

Both. The programme is 100% online with live sessions, and recordings are made available afterwards so you can revise or catch up.

Do I need to buy any software?+

No. The tools taught are free or open-source, or offer free versions, and the practice labs have free tiers.

How do I enrol?+

Create a free account, open this programme and click Enrol. You get access to the batch as soon as payment is confirmed.

What do I receive at the end?+

A NextGen Forensic certificate of completion with a unique ID that employers can verify on our website.

How long is the programme and what does it cost?+

One month. The course fee is ₹1,999, available now at a limited-time offer of ₹999.

Batch starts 1 Oct 2026 · Admissions open

Digital Forensics

Learn how digital evidence is collected, preserved, analysed and presented using industry-relevant tools and techniques.