Description

The number of incidents being reported is rapidly increasing every year. Organizations need to respond to these incidents and investigate what, when, why, where, who, and how they happened. This requires special skills and knowledge in systems and how they operate. This is not a simple task that can be handled by an IT professional, but only those trained to acquire and analyze information in a forensically sound manner.

Cyber 5W Digital Forensic Analysis course will guide students on how to conduct digital investigations and write investigative forensic reports. This course uses an experiential learning process for training students, where students learn digital forensics by doing investigative tasks on real-world cases. Students will learn how to perform evidence acquisition and how to deal with disks and file systems, and then explore the forensic artifacts one may encounter when working with the Windows operating system.

Learners who complete the course and pass the exam will earn the C5W Certified Digital Forensic Analyst (CCDFA).

Training Delivery Details

On Demand: Material | Certification of Completion | Exam Certification

The course material includes over 55 Hands-on Labs and 50 Videos

Pricing Options

Kindly choose the enrollment pricing option that suits you best. Please note that the fees include the Course Material and Two Exam attempts. If you're enrolling as a group or need a custom plan, please contact us. We're here to help!

  • C5W DIGITAL FORENSIC ANALYSIS - On-Demand Course

    Course Material + 40 hours of virtual lab access

    $650.00

    Buy Now

  • C5W DIGITAL FORENSIC ANALYSIS - On-Demand Course

    Course Material - No virtual lab access

    $600.00

    Buy Now

Course curriculum

    1. Welcome & Lab Access

    2. Before You Start (Beginning of the Course)

    3. Downloads

    4. Release Notes

    5. Want to Build Your Own Environment?

    1. What is Digital Forensics

    2. Digital Forensics Investigation

    3. Check Your Knowledge #1

    4. What is the Digital Evidence

    5. Digital Devices

    6. Legal Aspects

    7. Types of Digital Forensic Investigation

    8. Challenges of Digital Forensics

    9. Alternative Windows VM for Labs

    10. Lab #1 - Importing VMWare Virtual Machine

    11. Importing Virtual Machine to VMWare

    12. Configuring VMWare and VMTools

    13. Configuring a Shared Directory between the Host and VM

    14. Coping and Mounting CCDFA VHD Tools Drive

    15. Adding Extra Drive to VM

    16. Lab #2 - Importing VirtualBox Virtual Machine

    17. Working with Virtual Hard Disk

    1. Evidence Acquisition - Slides

    2. Data Acquisition Concepts

    3. Data Validation

    4. Acquisition Methods

    5. Forensic Image File formats

    6. Check Your Knowledge #1

    7. Why Evidence Acquisition Is Important?

    8. Must-Know First Response actions

    9. Sanitization

    10. Hardwipe Tool

    11. Cygwin Tools (dd command in Windows)

    12. Check Your Knowledge #2

    13. Required Files

    14. Lab #1 - Sanitizing the Target Media

    15. Lab #1 - Sanitizing the Target Media (Solution)

    16. Evidence Data Acquisition

    17. Memory Dump

    18. Memory Dump using WinPmem

    19. Tools for Memory Dump

    20. Disk Drive Imaging

    21. Other Forensic Tools

    22. Required Files

    23. Lab #2 - Creating Forensic Images

    24. Lab #2 - Creating Forensic Images (Solution)

    25. Examples of Hardware Acquisition Tools

    26. Using UltraDock Write-Blocker

    27. Resources

    1. Introduction to Image Mounting

    2. Arsenal Image Mounter

    3. OSFMount

    4. Other Forensic Image Mounting Tools

    5. Check Your Knowledge #1

    6. Required Files

    7. Lab #1 - Mounting using AIM

    8. Lab #1 - Mounting using AIM (Solution)

    9. Resources

    1. Working with FTK Imager - Slides

    2. Forensic Toolkit Imager

    3. Required Files

    4. Install FTK Locally

    5. Install FTK on a Portable Device (USB)

    6. Required Files

    7. Digital Evidence Acquisition

    8. Memory Acquisition

    9. Disk Acquisition

    10. Check Your Knowledge #1

    11. Lab #1 - Creating an E01 Image

    12. Lab #1 - Creating an E01 Image (Solutions)

    13. Lab #2 - Image Format

    14. Lab #2 - Image Format (Solutions)

    15. Lab #3 - Logical & Physical Image

    16. Lab #3 - Logical & Physical Image (Solutions)

    17. Required Files

    18. Add Evidence Item to FTK Imager

    19. Create and verify a multi-part disk images

    20. Loading a multi-part disk image

    21. Check Your Knowledge #2

    22. Required Files

    23. Evidence Analysis

    24. Exporting Data using FTK Imager

    25. Detect EFS Encryption

    26. Lab #4 - Exporting Evidence

    27. Lab #4 - Exporting Evidence (Solutions)

    28. Acquiring Protected Registry Files

    29. Copying Registry Files

    30. Required Files

    31. Interpreter

    32. Lab #5 - Interpreting Evidence

    33. Lab #5 - Interpreting Evidence (Solutions)

    34. Required Files

    35. Custom Content Images

    36. AD Encryption

    37. Lab #6 - Creating Custom Images

    38. Lab #6 - Creating Custom Images (Solutions)

    39. Required Files

    40. Image Mounting

    41. Steps of Image Mounting

    42. Mount Multi-Part Raw Disk Image with FTK

    1. Data Representation

    2. Introduction to Numbering System

    3. Decimal Number System (Base 10)

    4. Binary System (Base 2)

    5. Hexadecimal (Base 16)

    6. Octal (Base 8)

    7. Byte Ordering

    8. Introduction to Text Code

    9. ASCII Code

    10. Unicode

    11. Lab #1 - Numbering System

    12. Lab #1 - Numbering System (Solutions)

    13. Introduction to File Identification

    14. Installation of HxD Editor

    15. Working with HxD Editor

    16. Installation of 010 Editor

    17. Working with 010 Editor

    18. 010 Editor Course

    19. Introduction to File Signature

    20. Required Files

    21. Text Files

    22. Microsoft Word Files

    23. PDF Files

    24. TAR Files

    25. Zip Files

    26. PNG Files

    27. JPEG Files

    28. EXE Files

    29. MP3 Files

    30. MP4 Files

    31. System Metadata

    32. Embedded Metadata

    33. Required Files

    34. Lab #1 - Metadata & Hex-Editor Case 1

    35. Lab #2 - Metadata & Hex-Editor Case 2

    36. Lab #3 - Metadata & Hex-Editor Case 3

    37. Lab - Metadata & Hex-Editor (Solutions)

    38. Resources

    39. Required Files

    40. File Metadata Lab

    41. File Metadata Lab solutions

About this course

  • $650.00
  • 504 lessons
  • 7 hours of video content

🔍 Case Studies

Throughout the training, you’ll investigate and analyze real-world inspired scenarios designed to build your skills across diverse forensic challenges and attacker techniques. Some of the case studies include:

🕵🏻 No Prefetch? No Problem.
Learn how to trace malware or suspicious program execution even when traditional evidence like Prefetch files is missing. This case study walks you through advanced artifact correlation to build a timeline of attacker activity.

💣 Hunting Wipers: Uncovering sdelete and Beyond
Not all deletions are innocent. Dive into a case study where a threat actor uses sdelete to wipe their tracks and how forensic traces in NTFS, registry, and logs still tell the story.

🗑️ Deleted Doesn't Mean Gone.
Explore how deleted files, shortcuts, and shellbags can be recovered and interpreted to reconstruct user activity and attacker behavior in a compromised system.

🧪 Suspicious Installer or Admin Mistake?
Investigate a case where legitimate software was used as a LOLBin. You'll learn how to differentiate between administrator behavior and post-exploitation tactics.

📎 Malicious LNK Files: A Shortcut to Trouble
Learn how attackers use Windows shortcut files (.lnk) to execute malware silently. In this case study, you’ll recover and analyze LNK files to trace back user activity and uncover hidden execution paths.

👻 GhostTask Investigations: The Scheduled Jobs That Disappear
Uncover the mystery of Scheduled Tasks that leave minimal forensic traces. You’ll learn how attackers abuse Task Scheduler and how to recover or reconstruct their activity, even when tasks are deleted.

🔌 Execution from USB Devices: Following the Plug-in Trail
Explore a scenario where malware was launched from a removable device. You’ll trace USB insertions, mounted paths, and execution history using SetupAPI logs, registry entries, and forensic images.

🧹 Detecting Anti-Forensics: Timestomping and Log Tampering
Attackers may alter timestamps and clear logs to evade detection. This case study shows how to detect timestomping and use alternate forensic artifacts like $MFT, $LogFile, and $UsnJrnl to reconstruct the truth.

Instructor

Dr. Ali Hadi is a highly accomplished and experienced Senior Cybersecurity Specialist with 14+ years of professional experience in Information Technology. He is currently working as a full-time professor and researcher at the Computer and Digital Forensics and Cybersecurity Departments of Champlain College, USA. Ali is a Co-Founder and the Chief Technology Officer of Cyber 5W. He holds a PhD and MSc degree in Computer Information Systems, as well as a BSc degree in Computer Science. Throughout his professional career, Ali has earned more than 20 professional certifications. Ali is a sought-after consultant in the field of cybersecurity, offering expertise in areas such as digital forensics, incident response, adversary simulation, offensive security, and malware analysis. He is also an established author, speaker, and freelance instructor, having provided technical training to government and private firms as well as other organizations. Ali continues to be an influential figure in the digital forensics community and is dedicated to promoting forensics education and research. More details could be found here or contact him directly through twitter here.

CCDFA Certificate

Why you should get the CCDFA certificate?

  • Professional Certificate

    CCDFA is the only certification that will truly assess your skills in multiple domains, all using a single certification-process.

  • Experiential Learning

    CCDFA includes more than 35 hands-on labs that cover skills related to the basic of digital forensic, disks, file systems, and Windows.

  • Evaluated by Experts

    CCDFA requires students to take a practical assessment and submit a report for the expert committee to evaluate.

Learning Objectives

After completing this course, you are expected to:

  • Understand the fundamentals of digital forensic investigations

  • Demonstrate correct methods of evidence gathering

  • Learn how to extract file metadata and analyze files using a hex-editor

  • Summarize the analysis results and write investigative reports

  • Ability to analyze and fix corrupted disks

  • Ability to analyze FAT32 and NTFS file systems, plus recover and carve files from raw data

  • Ability to investigate Windows System Artifacts

  • Investigating Windows Program Execution Artifacts

  • Investigating Windows Registry and Windows Shellbags

  • Ability to analyze Windows Events Logs, Scheduled Tasks, and different Windows Applications (e.g. Skype, One Drive, etc)

Testimonials

“Breadcrumbs and Footprints... Affirmative .LNKs (pun intended) and Trace Evidence ... A ton of information, intelligence, and investigative leads are packed into Prefetch, Jumplist, LNK, and Thumbnail files.
"To a great mind nothing is little" -- S. Holmes.
Solid applicable Windows Forensics foundation from Dr. Ali Hadi and the Cyber5W Team. Here ”

Private Investigations | Digital Forensics

Eli W. Wilkerson

“This was a great day one! Really dived into it and wasn’t just a broad overview. Already working in VM’s and it is very hands on. Ali takes the time to answer all questions thoroughly. Here ”

Sarah

Prerequisites

This course assumes no prior experience in digital forensics or incident response. However, a foundational understanding of computer science, operating systems, file systems, or a related field is highly recommended.

Important: Learners should have experience installing software and working with virtual machines using a hypervisor. Please ensure you are comfortable setting up and managing virtual environments independently before starting the course.

The Value of the Training

Unlock the skills needed to identify, investigate, and understand digital incidents in a hands-on, guided environment. This training bridges the gap between theory and practice by walking you through real-world case scenarios, forensic imaging, artifact analysis, timeline reconstruction, and report writing.

Whether you're pursuing a career in digital forensics, incident response, or security operations, this course provides the core foundation and investigative techniques required to uncover evidence, trace attacker activity, and respond effectively in today's evolving threat landscape.

Who is this Certificate For?

This training is ideal for cybersecurity professionals, digital forensics analysts, SOC analysts, blue teamers, and anyone looking to build or strengthen their digital investigation skills.

Whether you're just entering the DFIR field or you're an experienced analyst looking to refine your techniques, this course offers a structured, hands-on approach to evidence acquisition, artifact analysis, and incident response, preparing you to investigate and respond to real-world security incidents with confidence.

System Requirements:

what you need to for the course

To ensure an optimal learning experience, participants should have access to a computer capable of running virtualization software such as VMware Workstation or VirtualBox, with at least 8 GB of RAM and 40 GB of free disk space.

We highly recommend using our hosted virtual lab environment, provided as part of the course. This eliminates the need to configure local virtual machines and allows you to seamlessly follow along with all hands-on exercises in a secure, controlled environment.

Refund Policy:

Refund requests for In-person and Online Virtual Training are accepted before the refund deadline and as long as the online course has not been accessed. To initiate a refund, please submit your request to [email protected]. The registration fee will be refunded, minus a $50 refund processing fee, to the original payment method. Please be advised that CYBER 5W OnDemand Courses are non-refundable and non-transferable once payment has been completed and course material has been accessed.