Digital Evidence

NDG Digital Evidence: Collection, Acquisition & Preservation

NDG Digital Evidence: Collection, Acquisition & Preservation builds working proficiency in handling digital evidence from scene arrival to laboratory intake. Learners identify storage media at a scene, apply legal seizure authority, acquire write-blocked forensic images, verify integrity with cryptographic hashes, and keep chain-of-custody records through packaging, transport, storage, and intake. Later chapters cover live and volatile data acquisition and the handling decisions specific to mobile, IoT, video, and cloud-connected devices. The course follows NDG Digital Forensics: From Evidence to Courtroom and assumes that course or equivalent knowledge.

All NETLAB+ supported labs for this course use the NDG Digital Evidence v1.0 Pod: a Debian forensic examiner workstation and a separate Linux suspect machine that serves as the live-acquisition target.

The course content is included with the labs, so no textbook is required: 12 chapters with quizzes and 20 labs. The 10 guided labs give step-by-step instructions and progressive hints; the 10 applied labs give the same scenarios as high-level tasks, with no hints, graded on completion. Chapters and labs are delivered through our HTML5 content viewer as Interactive Content, with integrated questions and instant feedback within the lab environment. To take advantage of the Interactive Content, keep your NETLAB+ system up to date with the latest version.