Digital Forensics

Free Digital Forensics Training

In this category, “Beginner” assumes that you have a general understanding of the four core categories listed on the home page.

Note: If you’re looking for Network Forensics, the majority of it is in the Incident Response section.

Name & Direct LinkPlatformFor BeginnersHands-On ComponentProof of CompletionTopics
Theoretical Digital Forensics Courses (There are both free and paid courses - the theoretical courses are free)

They also have communities based on the courses you're enrolled in where you can ask questions.
Cyber 5WYes (start with the intro courses)YesWindows Forensics, Linux Forensics, Evidence Acquisition, Working with Virtual Hard Disks, Linux Forensics Distros, Writing Forensics Reports
13Cubed's YouTube Channel

YouTube - 13CubedShimcache, Plaso, WSL 2, Cyber Triage, Log2Timeline, Windows Terminal, EventFinder2, Redline, macOS Forensics, iLEAPP, iOS Forensics, WMI, MFTECmd, SRUM, Timestamps, NTFS, LNK File, Jump Lists, Plaso, Shellbags, Recycle Bin Forensics, RDP Cache, Event Logs, CyberChef, Image Creation, KAPE, Volume Shadow Copies, EvtxECmd, Arsenal Image Mounter, Kansa, SIFT, Memory Analysis, Redline, Volatility, Persistence, Prefetch, Baselines, Windows Processes, Email Header Analysis
Digital Forensics BasicsTEEXYesEvidentiary Reporting, Computer Technologies, Digital Evidence Collection
Windows Forensics Workshop with Ali Hadi

Go HERE for the lab files.
YouTube - BSides AmmanYesWindows Forensics
Digital ForensicsOpenLearnYesYes - Statement of ParticipationDigital Forensics Process, History, Types of Digital Forensics
Computer ForensicsedXMust complete the edX Cybersecurity Fundamentals course first.Costs ExtraAnti-Forensics, Unix/Linux, Windows Memory Forensics, Windows File System, Forensics Tools, Artifacts, Acquisition, Analysis
Digital ForensicsHackers AriseYes - These are written tutorials that can be followed.Creating a Forensically Sound Image, Live Memory Acquisition and Analysis, Recovering Deleted Files, Registry Analysis, Pre-Fetch Files, Browser Forensics, Sysinternals, Extracting EXIF information, Android Mobile Forensics, Network Forensics
KAPE GuideAboutDFIRYesHow to Use KAPE, Examining KAPE Output, KAPE Related Videos and Blog Posts
Registry Explorer/RECmd GuideAboutDFIRYesRegistry Explorer GUI, Command Line, How to use rla.exe, Examining RECmd Output, Registry Related CTFs, Videos and Blog Posts
Timeline Explorer GuideAboutDFIRYesWhy Use Timeline Explorer, Updating EZ Tools, Timeline Explorer Related Blog Posts/Videos
Free Course Content from eForensics MagazineeForensics MagazineAndroid Mobile Forensics, File System Tunneling, EXT4 Layout, CyberChef Tutorial, Android Boot Process, FTK Imager Intro, Windows Registry Extraction with FTK Imager
Email Forensics WorkshopMetaspikeMessage Headers, DKIM, ARC, MIME, Server Metadata, Forensic Preservation Strategies
IoT Digital Forensics CourseGitHub - RJC497YesIoT Forensics, Fitbit, Echo, Smartwatch
Digital Forensics Training Materials (Slides & Command Line Cheat Sheet)circl.luPost-mortem Digital Forensics, File System Forensics and Data Recovery, Windows Memory and File Forensics
Cyber Forensics WorkshopYouTube - Ryan ChapmanYesYesNetwork Forensics, OSI Model, Encoding Schemes, File Signatures, Tools, Wireshark, Hex, ASCII, PCAP Analysis, Hashing, Covert Channels
Cellebrite Reader Online On DemandCellebriteYesYesCellebrite Reader, .UFDR reports
Cloud Forensics Course (scroll to the bottom of the page)HTCIACloud Forensics, Magnet Axiom
Free Paraben Training VideosParaben CorporationE3 Platform, Windows 10 Artifacts, Chip Dumps, Google Takeout Evidence, Importing Cellebrite Data, Processing WhatsApp Data, Data Triage, Email Deduplication, Office365 Acquisition, FitBit Data, Android Root Engine
Introduction to Digital ForensicsYouTube - DFIR.ScienceYesDigital Forensics, Cybercrime, Windows, Linux, Investigation Methods, Documentation and Reporting, Scientific Method, Data Storage, Acquisition, Photorec, tsk_recover, The Sleuth Kit, Autopsy, hfind, Malware, Memory Acquisition and Analysis, FTK Imager, Volatility, Mobile Device Aquisition, Network Analysis
An Introduction to Mobile ForensicsYouTube - MSABYesMobile Forensics
DFIR.Science YouTube ChannelYouTube - DFIR.ScienceDigital Forensics, SleuthKit, hfind, Tsurugi Linux, SDELETE, FTK Imager, File Mounting, Forensic Acquisition in Linux, DD, Volatility, LiME, Research, Scientific Method, Android Acquisition
Linux Forensics IntroInternet Archive - Hal PomeranzYesMemory Forensics, Tools, Volatility, Rootkits, IOCs, Disk Acquisition, File System, Disk Mounting, Artifacts, Disk Triage, Timeline Analysis, Logs, Syslog
Linux LEOLinux LEOYesYes - This is a detailed written guide with links to the Supplemental Files on the website. Go to "The Beginner's Guide" under Documents for the text.Linux Commands, Linux Boot Sequence, Linux Network Basics, Configuring a Forensic Workstation, Evidence Acquisition, Write Blocking, Tools, Mounting Images, Sleuth Kit, Network Investigation Tools
Linux Forensics Talks and WorkshopsGitHub - ashemeryYesLinux Forensics
XRY Reader to XAMN Viewer TransitionMSABXAMN Viewer capabilities that were not available in XRY Reader. XAMN Viewer is a free tool.
Trainings for Cybersecurity Specialists - Digital ForensicsENISAYesThis site contains handbooks with lab exercises, VMs, and Toolsets related to Digital Forensics.
macOS ForensicsYouTube - AccessDatamacOS Forensics, structure, artifacts, Plist
MFT Explorer/MFTECmd Guide AboutDFIRYesMFT Explorer, MFTECmd
NW3C Live Online TrainingNW3CThe training is intended for current US Criminal Justice Practitioners. An agency-issued email is needed.YesYesmacOS Forensics, iOS and Android Mobile Forensics, Cyber Investigations, Cellular Records Analysis, Digital Footprints, Dark Web & OSINT, Seizure, Windows Acquisition, Windows Forensics, Advertising Identifiers, Virtual Currency, Automated Forensic Tools, SQLite,
MOBILedit Forensic Express TrainingMOBILeditYesYesMOBILEdit Forensic Express Installation, Settings, Updates, Connecting a Phone, Importing Data, Connecting to iCloud, Creating Reports, Analyzing Images, Hacking Phones
Mobile Forensics: An Introduction - Josh BruntyYouTube - Adrian CrenshawYesMobile Forensics
How to Learn Forensics RoadmapHoppers RoppersYesFile Forensics, Host and Memory Forensics, Network Forensics
Digital Forensics Applied to Containers - Enhancing Intruder DilemmaYouTube - Peter StaarfaengerContainer Forensics, Docker
Container Forensics: What to Do When Your Cluster is a Cluster - Maya Kaczorowski & Ann WallaceYouTube - CNCF [Cloud Native Computing Foundation]Container Forensics, Kubernetes