Digital Evidence: Collection, Acquisition & Preservation is available now on NDG Online and as a lab library for NETLAB+ systems. It follows Digital Forensics: From Evidence to Courtroom and takes that course's coverage of chain of custody, legal authority, and first-responder protocols to working proficiency. The focus is the procedures that carry digital evidence from a scene to the laboratory.
Who it's for
- Digital evidence technicians building proficiency in seizure, acquisition, and preservation
- High-tech crime, computer crime, and cyber crime investigators who handle devices in casework
- First responders who make the first decisions at scenes involving digital evidence
- Evidence custodians and chain-of-custody coordinators
The recommended prerequisite is Digital Forensics: From Evidence to Courtroom or equivalent foundational knowledge. The guided labs teach the Linux terminal commands step by step.
What's inside
The course runs 24 hours: 12 chapters with quizzes and 20 labs, 10 guided and 10 applied. Guided labs give step-by-step instructions and progressive hints. Applied labs give the same scenarios as high-level tasks, with no hints, graded on completion.
Along the way you practice:
- Identifying and triaging storage media at a scene, including hidden and embedded storage
- Applying warrant scope, consent, and exigent circumstances to seizure decisions
- Acquiring forensic images behind a validated write block with Guymager, dc3dd, and ewf-tools
- Verifying integrity with hashdeep and sha256sum
- Keeping chain-of-custody records through packaging, transport, storage, and laboratory intake
- Capturing volatile data from a live system with AVML
Later chapters cover the handling decisions specific to mobile, IoT, video, and cloud-connected devices. The labs run on a Debian forensic examiner workstation, with a separate Linux suspect machine as the live-acquisition target.
Standards alignment
The course's evidence-handling competencies align with major digital forensics certifications. Its procedures follow the SWGDE best-practice series, ISO/IEC 27037, NIST SP 800-86, and RFC 3227. It is a certificate-of-completion course, not exam preparation.
On NDG Online
Digital Evidence: Collection, Acquisition & Preservation runs in the browser with nothing to install. Access lasts 6 months per purchase. Instructors can teach it as a class, and teams can buy access through a price quote.
On NETLAB+
The NDG Digital Evidence: Collection, Acquisition & Preservation lab library includes the course content with the labs: the 12 chapters, quizzes, and 20 guided and applied labs, so no textbook is needed. It uses the NDG Digital Evidence v1.0 Pod and NDG's Interactive Content in the HTML5 content viewer, with integrated questions and instant feedback. Install the course with the Course Manager; the cybersecurity content release notes list the VM builds.