Phones, doorbell cameras, smart speakers, and GPS data now sit at the center of investigations and trials. The people who handle that evidence, from the officer at the scene to the judge ruling on admissibility, rarely get training built for them: forensics courses assume a technical audience, and legal training rarely touches the tools.
Digital Forensics: From Evidence to Courtroom is our answer. It is a foundational course for the justice system, written in plain language, taught through real cases, and practiced in guided labs that run in your browser. No prior technical or forensics experience is required.
Who it's for
The course is built for the roles that work with digital evidence every day:
- Law enforcement: patrol officers, first responders, detectives, and investigators
- Prosecutors and defense attorneys handling cases with digital evidence
- Judges and magistrates ruling on warrants and admissibility
- Forensic paralegals and litigation staff who prepare and manage evidence
- Criminal justice students and new practitioners entering the field
If you can open a file and use a web browser, you meet the prerequisites.
What's inside
The course spans 12 modules and about 24 hours. Every module pairs readable, plain-language instruction with a quiz, and nine of the 12 carry labs in two versions, 18 in all. Guided labs give step-by-step instructions and hints; applied labs give the same scenario as tasks, without the steps, and grade at the end. The course finishes with an end-to-end case simulation.
Along the way you work through the full life cycle of digital evidence:
- The evidence domains that show up in real cases: mobile devices, video (CCTV, body cameras, dashcams, doorbells), IoT and smart-home devices, and vehicle tracking and location data
- The legal frameworks that govern collection: the Fourth Amendment, ECPA, SCA, and Carpenter
- First-responder protocols so evidence isn't lost or excluded
- Warrant drafting for phones, cloud accounts, IoT devices, and location data
- Courtroom presentation, including authentication and challenges under Daubert and Frye
- AI and emerging technology: AI-assisted analysis, deepfake detection, and the reliability of AI-generated evidence
Labs run in a forensic workstation in your browser, using Autopsy, ExifTool, MediaInfo, and SQLite Browser. All evidence is fictional and synthetic, and every lab is sandboxed, so there is nothing to install and no real case data.
Certification and framework alignment
The course maps to foundational objectives from digital-forensics certifications including IACIS CFCE, ISFCE CCE, GIAC GCFE, and EC-Council CHFI, and to CompTIA Security+. It also aligns with the NICE Framework, NIST SP 800-86, SWGDE standards, and DOJ electronic-evidence guidance. It maps to foundational objectives; it is not a certification exam or a guarantee of certification.
For departments, agencies, and classrooms
The course is designed to train a whole class, at any level of technical background. Educators and training coordinators get per-module PowerPoint decks, a full syllabus, an instructor guide, progress tracking, and LMS integration. Every lab has a guided and an applied version, so you can scale difficulty to your class.
On NETLAB+
Organizations running their own lab infrastructure can install the NDG Digital Forensics lab library on NETLAB+. The library includes the course content along with the labs: the 12 chapters, quizzes, and instructor materials, so no textbook is needed. It uses the NDG Digital Forensics v1.0 Pod and NDG's Interactive Content experience: chapters, lab exercises, and integrated questions with instant feedback in the HTML5 content viewer.
Get the course
Visit the Digital Forensics: From Evidence to Courtroom course page for the full curriculum, FAQ, and a downloadable brochure. To bring the course to your organization, use the "Teach this in a class" option on the course page or contact us.