Digital Evidence: Collection, Acquisition & Preservation
Hands-on digital evidence handling from scene arrival to laboratory intake: seizure authority, write-blocked imaging, hash verification, packaging, and chain of custody. Builds on Digital Forensics: From Evidence to Courtroom.
About this course
NDG Digital Evidence: Collection, Acquisition & Preservation builds working proficiency in handling digital evidence from scene arrival to laboratory intake. You'll work as the evidence technician on two running cases, a warrant search and a consent seizure, in a two-machine virtual lab: a forensic examiner workstation and a separate Linux suspect machine. The course builds on Digital Forensics: From Evidence to Courtroom, or equivalent foundational knowledge. Linux commands are taught step by step in the guided labs.
The course follows the evidence lifecycle: identifying storage media at a scene, legal seizure authority, write blocking and forensic imaging, hash verification, packaging and transport, chain-of-custody documentation, evidence storage and lab intake, live and volatile data acquisition, and the handling decisions specific to mobile, IoT, video, and cloud evidence. Procedures follow the SWGDE best-practice series, with ISO/IEC 27037, NIST SP 800-86, and RFC 3227 as foundational references.
Course Features
- 12 modules (24 hours), each ending in a quiz
- 20 labs: 10 guided (step-by-step, with hints) and 10 applied (the same scenarios as tasks, no hints, graded at the end)
- A challenge lab, The Lakeview Seizure: a full seizure-to-intake case, graded automatically on your lab machine
- Hands-on work with Guymager, dc3dd, ewf-tools, hashdeep, AVML, and Autopsy
- For digital evidence technicians, investigators, first responders, and evidence custodians
What you'll learn
Chapter 01: The Digital Evidence Technician: Role, Standards and Scene Management
Chapter 02: Legal Authority for Search and Seizure
Chapter 03: Storage Media and Device Identification
Chapter 04: Write Blocking and Forensic Soundness
Chapter 05: Forensic Imaging
Chapter 06: Hashing and Integrity Verification
Chapter 07: Packaging, Labeling and Transport
Chapter 08: Chain of Custody Documentation
Chapter 09: Evidence Storage and Lab Intake
Chapter 10: Live and Volatile Data Acquisition
Chapter 11: Mobile, IoT, Video and Cloud Evidence Handling
Chapter 12: Comprehensive Review and Evidence-Handling Case Simulation
Guided Lab 01: The Digital Evidence Technician: Role, Standards and Scene Management
Guided Lab 03: Storage Media and Device Identification
Guided Lab 04: Write Blocking and Forensic Soundness
Guided Lab 05: Forensic Imaging
Guided Lab 06: Hashing and Integrity Verification
Guided Lab 07: Packaging, Labeling and Transport
Guided Lab 08: Chain of Custody Documentation
Guided Lab 09: Evidence Storage and Lab Intake
Guided Lab 10: Live and Volatile Data Acquisition
Guided Lab 11: Mobile, IoT, Video and Cloud Evidence Handling
Applied Lab 01: The Digital Evidence Technician: Role, Standards and Scene Management
Applied Lab 03: Storage Media and Device Identification
Applied Lab 04: Write Blocking and Forensic Soundness
Applied Lab 05: Forensic Imaging
Applied Lab 06: Hashing and Integrity Verification
Applied Lab 07: Packaging, Labeling and Transport
Applied Lab 08: Chain of Custody Documentation
Applied Lab 09: Evidence Storage and Lab Intake
Applied Lab 10: Live and Volatile Data Acquisition
Applied Lab 11: Mobile, IoT, Video and Cloud Evidence Handling
What's in this course
Prerequisites
- Digital Forensics: From Evidence to Courtroom, or equivalent foundational knowledge
- Basic comfort working in a Linux terminal (commands are taught step by step in the guided labs)
Best for
- Digital evidence technicians building working proficiency in seizure, acquisition, and preservation
- High-tech crime, computer crime, and cyber crime investigators who handle devices in casework
- First responders who make the first-minutes decisions at scenes involving digital evidence
- Forensic evidence custodians and chain-of-custody coordinators
Common questions
Do I need to take Digital Forensics: From Evidence to Courtroom first?
It is the recommended prerequisite. This course takes that course's awareness-level coverage of chain of custody, legal frameworks, first-responder protocols, and warrants to working proficiency. Learners with equivalent foundational knowledge can start here.
How do the guided and applied labs differ?
There are 20 labs, 10 guided and 10 applied, paired on the same scenarios. Guided labs give step-by-step instructions and progressive hints. Applied labs give high-level tasks with no hints and are graded on completion.
Which certifications does the course align with?
Its evidence-handling competencies align with IACIS CFCE, ISFCE CCE, GIAC GCFE, and EC-Council CHFI. Procedures follow the SWGDE best-practice series, ISO/IEC 27037, NIST SP 800-86, and RFC 3227. It is a certificate-of-completion course, not exam preparation.
How is this course different from NDG Forensics v2?
NDG Forensics v2 centers on forensic analysis. Digital Evidence: Collection, Acquisition & Preservation covers what happens before analysis: seizing devices, acquiring and verifying images, and keeping the evidence and its records intact from the scene to the laboratory.