Six modules covering the full forensics lifecycle: evidence preservation, file systems, mobile devices, network activity, and legal considerations. Great for beginners, IT analysts, and aspiring investigators who want the thinking behind evidence handling, not just tools. It also touches on live acquisitions from RAM and mobile devices, which gives beginners an early taste of the more advanced material they’ll meet later

Twelve modules, no prior experience needed. Covers the investigation process, network forensics, event correlation, data acquisition, plus dark web and email crime investigations that a lot of beginner courses skip entirely. The breadth here is genuinely unusual for an entry-level course, and it gives learners a realistic sense of how many directions a single case can branch into.

Builds on the standard DFE course with actual lab setup, crime-scene documentation, search and seizure practice, and evidence preservation as a real workflow rather than theory. If you finished the standard DFE course and felt like you understood the concepts but hadn’t actually done anything, this is the natural next stop.

A three-course concentration in the areas of finding and retrieving forensic evidence with particular emphasis on Windows forensics and Registry analysis. For students with a basic IT foundation that would prefer a learning pathway over one course that ultimately starts and ends abruptly when it’s at its most interesting.

A short, genuinely useful hands-on lab: core concepts, a guided exercise, and a challenge exercise using Autopsy to analyze a drive image and pull evidence yourself. It’s brief by design, but that hour of active clicking teaches more than a much longer video course would.

Coursera’s full digital forensics catalog spans data recovery, evidence analysis, incident response, and tools across many difficulty levels. Useful once you’re ready to branch into a specialization, or just want to browse what other institutions are teaching before you commit to one path.

edX’s catalog of investigation, evidence handling, and cybersecurity resources, with a consistent focus on structured procedure. A solid way to find university-affiliated programs that Coursera’s catalog might not surface.

A structured introduction to digital forensics that covers how forensic investigations work, how digital evidence is gathered and analysed, and how digital forensics connects with traditional forensic science. It also looks at different areas of digital forensics and the legal side of handling evidence. The course is free to study through OpenLearn and includes a free statement of participation, making it a useful academic foundation before moving into hands-on tools and labs.

This course takes learners through the practical side of a digital forensic investigation, from understanding cybercrime and investigative procedures to collecting volatile and non-volatile data. It also introduces forensic tools used across Windows, Linux, and Macintosh environments, along with topics such as firewall analysis and the challenges investigators can face during cybercrime investigations. It is a useful option for learners who want a focused introduction to forensic investigation without committing to a long program.

The essential companion to any Autopsy lab, covering case management, disk images, file-system analysis, keyword search, and timeline building. Bridges theory and real investigative work faster than almost anything else on this list, mostly because it’s documentation for a tool people actually use in paid casework

The open-source, command-line toolset that powers Autopsy behind the scenes. Understanding it at this lower level makes you far more effective when a case doesn’t behave as expected, since the graphical interface can only take you so far before you need to know what’s actually happening underneath.

A collection of free, open-source forensic tools bundled into one Linux environment for incident response. The documentation shows how a forensic workstation actually gets assembled and used, which is genuinely helpful if you’re used to installing tools one at a time and never quite getting them to play well together.

The standard framework for memory forensics. Explains how a RAM capture reveals running processes, network connections, and loaded modules before they disappear at shutdown, which is exactly the kind of volatile evidence that disk forensics alone will never catch.

The current, actively maintained version of the framework. Working through the repository and docs is the practical path to extracting evidence from memory dumps in a controlled lab, and it’s worth doing even if you’ve already read the general documentation above, since the plugin ecosystem changes often enough to reward staying current.

The open-source packet analyzer nearly every network defender relies on. Covers capturing and examining traffic, identifying protocols, and interpreting packet-level evidence for real investigations, whether you’re chasing down a suspicious outbound connection or trying to reconstruct a timeline of network activity

A more granular, step-by-step reference for capturing, filtering, and analyzing traffic. Worth keeping open while working through any network-forensics lab, since it’s the kind of document you’ll return to repeatedly rather than read once and set aside.

Free guidance on digital evidence, forensic technique, and investigation that becomes especially useful once you’re past tool-learning and thinking harder about defensible processes. It’s dry reading compared to a hands-on lab, but the rigor it teaches shows up in how convincing your reports are later.

This course gives learners a practical introduction to digital forensics, starting with the fundamentals and showing how forensic techniques are used in real-world situations. It covers digital evidence preservation, hashing, chain of custody, data recovery, email forensics, and different branches of digital forensics. The course also includes practical simulations involving evidence collection, email header analysis, data recovery, and forensic imaging tools, along with an overview of Indian laws related to cybercrime.

Explains how forensic techniques fit into incident response: preparation, collection, examination, analysis, and reporting as one connected lifecycle rather than separate steps. It’s one of the clearer free documents for understanding how forensics and incident response actually overlap in practice.

This NIST publication explains how organisations can prepare for, respond to, and recover from cybersecurity incidents. It covers incident-response activities within a broader risk-management approach and is useful for understanding where investigation and evidence handling fit into an incident-response process. For digital forensics learners, it provides valuable context around what happens before and after forensic analysis rather than focusing only on individual tools or techniques.

Free best-practice documents on collecting, preserving, examining, and reporting digital evidence. These are professional standards documents that genuinely shape defensible methodology, the kind referenced in actual courtroom testimony rather than just cited in a syllabus.

A broader library covering computer, mobile, and multimedia forensic disciplines. Useful once you’re ready to go deeper into a specific specialty and want material written for practitioners rather than students.

A practical introduction to digital forensics built around the evidence people encounter in real investigations. The course covers mobile devices, video evidence, IoT and smart devices, vehicle and location data, first-responder procedures, legal considerations, and courtroom preparation. It also includes browser-based labs using tools such as Autopsy, ExifTool, and MediaInfo, so you’re not just reading about forensic evidence—you actually work with it in guided scenarios. No prior technical or forensics experience is required.