This course builds what federal employees need in order to conduct sound digital forensics and incident investigations — not merely to establish that something happened, but to prove what, when, and how, defensibly. It is organized around the NIST SP 800-86 forensic process (Collection, Examination, Analysis, Reporting) and integrates IOC investigation, chain of custody, and the federal legal and oversight framework: the Federal Rules of Evidence, OIG and counsel coordination, ISO/IEC 27037 and 27041-43, and SWGDE. A full capstone investigation closes the course, worked through with the instructor.
Completing it also credits toward the Digital Forensics & Incident Response certificate, which in turn rolls up into the Cyber Operations Professional credential.
