Advanced Digital Forensics

Course Description

Advanced Digital Forensics covers the forensic process; NTFS, EXT and HFS+ file systems; Windows registry forensics; RAM and swap capture; and mobile device forensics. It is a hands-on learning experience that requires students to have prior knowledge of computer systems and Linux.

Within the SCNS taxonomy, CET is the Computer Engineering Technology prefix. Daytona State publishes this at 3 credits, offered fall, with CET4860 as prerequisite, giving approximately 45 contact hours at the prefix's unsuffixed convention.

The step up from the introductory course is substantial and it is a step in two directions at once. The file systems get harder — NTFS, EXT and HFS+ are far more complex than FAT, and each stores metadata differently. And the evidence sources multiply: the Windows registry, volatile memory, and mobile devices are each a specialised discipline in their own right. Memory forensics in particular changes what is findable, because a great deal of what matters in a modern intrusion never touches disk at all.

⚠ The Linux prerequisite is real. Much advanced forensic tooling is command-line and Linux-based, and students who are not comfortable in a shell will spend this course fighting the environment rather than learning the subject.

Daytona State does not publish a lecture and laboratory split for its CET courses. The prefix's unsuffixed courses run consistently at 15 contact hours per credit — CET1588, CET2544, CET2691, CET2792, CET2793, CET2794, CET3505 and CET4542 are all published at 3 credits and 45 hours, without exception. Its C-suffixed courses run at 20 or above and its L-suffixed laboratories at 30. This course is unsuffixed and is priced at the unsuffixed convention.

Learning Outcomes

Required Outcomes

• Describe the NTFS file system and its major structures.
• Interpret the NTFS master file table and its attributes.
• Describe NTFS alternate data streams and their forensic significance.
• Describe journaling in NTFS and its evidentiary value.
• Describe the EXT family of file systems and their structures.
• Describe the HFS+ file system and its structures.
• Recover data from NTFS, EXT and HFS+ volumes.
• Compare metadata and timestamp behaviour across file systems.
• Describe the structure and purpose of the Windows registry.
• Locate and interpret registry hives and their contents.
• Extract evidence of user activity, devices, and program execution from the registry.
• Interpret registry timestamps and correlate them with other artifacts.
• Describe volatile data and the order of volatility.
• Perform RAM capture using appropriate tooling.
• Analyse a memory image for processes, connections, and injected code.
• Describe swap and paging files and their forensic content.
• Describe the trade-off between live acquisition and evidence integrity.
• Describe mobile device architecture and storage.
• Describe mobile acquisition methods, logical and physical.
• Describe the effect of encryption and locked devices on mobile acquisition.
• Extract and interpret mobile artifacts, including messaging and location data.
• Correlate evidence across multiple sources into a coherent timeline.
• Document an advanced examination defensibly.
• Report findings accurately, including limitations and uncertainty.

Optional Outcomes

• Describe anti-forensics and detect its use.
• Describe full-disk encryption and approaches to encrypted evidence.
• Describe macOS-specific forensic artifacts.
• Describe Linux system artifacts and log analysis.
• Describe cloud-synchronised data and its implications.
• Prepare for an advanced forensic certification.

Major Topics

Required Topics

• NTFS structures
• The master file table
• Alternate data streams
• NTFS journaling
• EXT file systems
• HFS+ file system
• Cross-file-system recovery
• Metadata and timestamp comparison
• Windows registry structure
• Registry hives
• User, device and execution artifacts
• Registry timestamps
• Volatile data and order of volatility
• RAM capture
• Memory image analysis
• Swap and paging files
• Live acquisition trade-offs
• Mobile device architecture
• Mobile acquisition methods
• Encryption and locked devices
• Mobile artifact interpretation
• Cross-source correlation
• Advanced examination documentation
• Reporting limitations and uncertainty

Optional Topics

• Anti-forensics detection
• Full-disk encryption
• macOS artifacts
• Linux artifacts and logs
• Cloud-synchronised data
• Advanced certification preparation

Resources & Tools

• The programme's laboratory and its isolated network — the only place you can lawfully practise most of this. Use every scheduled hour and every open-lab hour.
• Virtualisation software — VirtualBox is free, VMware Workstation Player is free for personal use; a home lab of virtual machines costs nothing but disk space.
• Kali Linux and the SANS SIFT Workstation — free tool distributions for security testing and forensics respectively.
• Autopsy and The Sleuth Kit (sleuthkit.org) — free and open-source forensic tools used professionally, not merely for teaching.
• NIST Computer Forensics Tool Testing programme (cftt.nist.gov) — free tool validation reports; the reference when you need to defend a tool choice.
• NIST Special Publications, especially SP 800-86 (forensic techniques in incident response) and SP 800-61 (incident handling) — free, authoritative, and directly examinable.
• CISA (cisa.gov) — free advisories, guidance, and free training resources.
• MITRE ATT&CK (attack.mitre.org) — free; the standard framework for describing adversary behaviour, and increasingly expected knowledge.
• TryHackMe, Hack The Box, and OverTheWire — lawful practice environments, with free tiers; the right place to practise offensive technique.
• CompTIA and Cisco Networking Academy materials — aligned to the certifications employers ask for.
• File System Forensic Analysis (Carrier) — the NTFS and EXT chapters are the reference for this course.
• The Art of Memory Forensics (Ligh et al.) — the memory forensics text, built around Volatility.
• Windows Registry Forensics (Carvey) — the standard on registry analysis.
• Volatility and Rekall — free and open-source memory analysis frameworks used professionally.
• RegRipper — free; the standard registry extraction tool.

Career Pathways

• Information security analyst — SOC 15-1212; consistently among the fastest-growing occupations.
• Computer network support specialist — SOC 15-1231; computer user support specialist — SOC 15-1232.
• Network and computer systems administrator — SOC 15-1244.
• Digital forensics examiner — in law enforcement, in corporate investigations, and in consulting firms.
• Incident responder and security operations centre analyst — a large and growing entry route into security.
• Electrical and electronics engineering technologist or technician — SOC 17-3023, for the digital design pathway.
• Embedded systems and FPGA development — a specialised, well-paid pathway from the digital design sequence.
• Florida's defence, space, and simulation sector — the Space Coast, Orlando's simulation and training cluster, and Tampa's defence presence all hire heavily in these areas, and many roles require U.S. citizenship and a security clearance.
• Public sector and law enforcement — state and county agencies, and federal offices with a large Florida presence.
• Healthcare, financial services, and hospitality IT — all large Florida sectors with substantial compliance-driven security demand.
• Consulting and managed security service providers.
• ⚠ Many security and forensics roles require a clean background — criminal history, and for cleared work significant unresolved debt or foreign contacts, can be disqualifying. Find this out before investing in the pathway.

Special Information

⚠⚠ Memory forensics changes what is findable — and the evidence disappears at power-off

• A great deal of modern intrusion activity never touches disk. Fileless malware, injected code, decrypted keys, and network connections exist in memory and nowhere else.
• Follow the order of volatility. Registers and cache, then memory, then network state, then disk — capture the most perishable first, because the decision to pull the plug destroys it permanently.
• ⚠ Live acquisition alters the system you are acquiring from, which sits in genuine tension with the "never change the evidence" principle. The resolution is documentation, not avoidance — record what you ran, when, and what footprint it left, and be able to explain the trade-off.
• Decide before you arrive whether the situation calls for live capture, and have the tooling ready on trusted media.
• Encryption keys live in memory while a volume is mounted. Powering down an encrypted machine may make the disk permanently unreadable — this is one of the most consequential on-scene decisions in the field.
• Memory analysis finds processes hidden from the operating system, which is exactly why rootkits are detectable this way and not otherwise.
• Corroborate memory findings against disk and network evidence where possible.
• Document your acquisition tooling and its version. Memory acquisition tools differ in what they capture and how, and you may be asked.

⚠ Mobile forensics is a distinct discipline with distinct obstacles

• Phones are where the evidence increasingly is, and they are the hardest devices to acquire from.
• Encryption and secure enclaves mean a locked modern device may be unrecoverable by any lawful means available to you. Say so plainly rather than implying otherwise.
• Isolate the device immediately — airplane mode, a Faraday bag, or a shielded room. A connected phone can be remotely wiped, and that has destroyed evidence in real cases.
• Preserve power. A device that runs flat may re-lock into a state that is harder to acquire from.
• Logical, file system, and physical acquisitions differ in what they recover, and which is available depends on the device, its version, and its lock state.
• Application data is where the content usually is — messaging, location history, and cloud-synchronised material.
• Cloud synchronisation raises separate legal questions about authority to access data not on the device.
• Tool support lags device releases, sometimes by a long way, and a tool that cannot acquire a device today may be able to next year.

⚠⚠ Chain of custody and admissibility — evidence you cannot defend is evidence you do not have

• The technical work is only half of digital forensics; the other half is being able to prove, later and under challenge, that what you produced is what was there. An analysis that cannot be defended in a hearing is an analysis that did not happen.
• Never work on the original. Acquire a forensic image using a hardware or software write-blocker, verify it, and work only from copies.
• Hash everything, before and after. A cryptographic hash of the source and of the image, recorded at acquisition and re-verified afterwards, is what demonstrates the data has not changed. Record the algorithm and the values in your notes, not just in the tool's log.
• Document chain of custody continuously — who had the evidence, when, where it was stored, and every transfer, signed. A single unexplained gap can exclude the evidence entirely.
• Contemporaneous notes are the deliverable. What you did, when, with which tool and version, and why. You may testify years later, and you will have only what you wrote.
• Your process must be reproducible by another examiner reaching the same result — that is what makes it a method rather than an opinion.
• Validate your tools and know their limitations; "the software said so" is not a finding you can defend.
• Report what you found, including what does not support the theory you were asked about. An examiner who reports selectively is not an expert witness, and it will be exposed.
• Stay within your competence. Testifying beyond what you can actually support is how examiners are discredited.
• ⚠ Standards for expert testimony have changed in Florida in recent years, and the admissibility of technical evidence is a live legal question. Rule 11 applies — work with counsel and verify the current standard rather than relying on this guide.

⚠⚠ Authorisation is the line between a security professional and a defendant

• Never access, scan, or test a system you do not have written permission to touch. Not a friend's network, not your employer's without authority, not a "harmless" port scan of a site you use. This is the one rule in this field that carries criminal consequences.
• Federal exposure: the Computer Fraud and Abuse Act criminalises unauthorised access to a protected computer, and "exceeding authorised access" has been read broadly.
• ⚠⚠ Florida exposure is separate and additional: the Florida Computer Crimes Act, Chapter 815, Florida Statutes, makes offences against intellectual property, computer users, and computer equipment punishable under state law independently of federal law. A student who assumes only federal law applies is wrong.
• Curiosity is not a defence, and neither is intent to help. Discovering a vulnerability and testing it without authorisation is an offence even when you meant to report it.
• Use the lab. Your programme provides an isolated environment precisely so you can practise techniques that would be unlawful elsewhere — build your own isolated lab at home too, and keep it off the production network.
• Get scope in writing before any authorised engagement — systems, addresses, times, techniques permitted, and who to contact when something breaks. A verbal "go ahead" protects nobody.
• Stay inside scope once you start. Following an interesting path onto a system not covered by the authorisation is where legitimate testers get into trouble.
• Responsible disclosure has a process. Follow the vendor's or organisation's published route, and do not publish details before it has been addressed.
• ⚠ Rule 11 applies. Computer crime, privacy, and disclosure law changes; verify current law and take advice rather than relying on a course guide.

⚠ Certifications carry real weight in this field — more than in most

• Information technology and security hire on demonstrated capability, and certifications are the common shorthand for it — frequently appearing as hard requirements in job postings and in government and contractor roles.
• Foundational: CompTIA A+ (hardware and operating systems), Network+, and Security+. Security+ in particular satisfies a widely cited U.S. Department of Defense baseline requirement, which makes it valuable in Florida's substantial defence and contractor sector.
• Networking: Cisco CCNA remains the recognised entry credential.
• Digital forensics: EnCE (EnCase), ACE (AccessData), CCE, and the SANS GCFE and GCFA. The SANS credentials are the most respected and by far the most expensive — employers frequently pay for them, so raise it at interview rather than self-funding.
• Security management: CISSP is the senior standard but requires several years of documented experience; SSCP is its practitioner-level counterpart and is reachable earlier.
• Time your certification to your coursework. Sit the examination while the material is fresh — pass rates fall sharply the longer graduates wait.
• Certifications expire. Most require continuing education and renewal, so plan for the ongoing cost.
• ⚠ A certification is not a substitute for the degree, and the degree is not a substitute for certifications. Employers in this field commonly want both, plus evidence you have actually built and broken things.
• Build a home lab and document it. Virtual machines cost nothing, and a candidate who can describe what they built and what went wrong interviews far better than one who lists courses.

How Florida course levels affect transfer

The first digit of an SCNS number denotes the year of offering, not transferability. Courses at the 1000 and 2000 levels transfer transparently between Florida public institutions, and 3000 to 4000 is unproblematic since both are upper division. The boundary that actually matters is 2000 to 3000, where lower-division credit generally cannot satisfy an upper-division requirement.

⚠ That boundary is live in this prefix. Daytona State offers CET courses at the 1000, 2000, 3000 and 4000 levels, the upper-division ones forming part of a bachelor of applied science. A 2000-level CET course does not substitute for its 3000- or 4000-level counterpart even where the subject matter overlaps — compare CET2880C/CET2881C (Data Forensics I and II, lower division) with CET4860/CET4861 (Introduction to and Advanced Digital Forensics, upper division). Confirm with an advisor which lower-division courses feed the BAS.

CET4861 is 3 credits and approximately 45 contact hours, offered fall at Daytona State, prerequisite CET4860.

⚠ Comfort with Linux and the command line is assumed, not taught — if that is weak, address it before the course starts. See also CET4862 (Network Forensics and Incident Response).