Digital Forensics Research & Training Institute

Deleted is not gone. Learn to prove it.

Hands-on digital forensics training online and in our labs. Phones, hard drives, CCTV, networks, cloud and malware, taught on real devices by people who work cases.

Explore 27 courses Talk to a counsellor

27: courses
7: tracks
6: certifications
5: ways to learn

Exhibit AHard drive

Write-blocker connectedImage format E01SHA-256 hash matchedReading sector 12,45,778

Learn to examine a hard drive

Which device holds your evidence?

Pick a device. See what it can still give up, the first steps at the scene, the mistake that loses evidence and the course that teaches you to do it right.

Exhibit 01 / 14

Smartphone

Most cases today have a phone in them somewhere. Even after chats are deleted, a lot is still sitting in the phone's databases.

What it can still give up

Chats and call logs from app databases
Photos and videos with GPS tags and capture time
Location history, Wi-Fi networks and Bluetooth pairings
Deleted rows still inside SQLite free pages and WAL files
Accounts, installed apps and UPI or banking app traces

First steps at the scene

1Photograph the screen and note whether the phone is locked
2Use airplane mode or a Faraday bag so it cannot be wiped remotely
3Keep it charged. A restart can lock user data behind the passcode

Watch outA phone that restarts goes back to a locked state, and most user data stays encrypted until the passcode is entered.

Tools you will use

Cellebrite UFED
Magnet AXIOM
Oxygen Forensic Detective
ALEAPP
iLEAPP

Learn it in

27 courses in seven tracks

See all courses

StorageHDD ForensicsImage hard drives through a write-blocker, find hidden areas and recover deleted data.IntermediateDCFA

StorageSSD / NVMe ForensicsHow TRIM, garbage collection and wear levelling change evidence on SSD and NVMe drives.AdvancedDCFA

StorageUSB / Pen Drive ForensicsExamine pen drives and memory sticks and prove which USB device touched which computer.BeginnerDCFA

StorageRAID / NAS ForensicsImage RAID members, rebuild arrays virtually and examine NAS boxes after ransomware.AdvancedDCFA

StorageFile System AnalysisRead NTFS, FAT, exFAT, ext4 and APFS at the structure level and build timelines.IntermediateDCFA

All Digital Storage Forensics courses

From your first lesson to the bench

Most learners follow this path. You can join at any step if you already have the basics.

StartFoundation
Forensic principles, chain of custody, report writing and how evidence is treated in court.
Basics of Cyber Forensics Forensic Report Writing Legal & Court Procedures
BuildOne core track
Go deep on the evidence you will meet most: storage, mobile or network.
HDD Forensics Android Forensics Network Traffic Analysis
ProveCore certification
Show employers what you can do with DCFA, DCMFE or DCNI.
DCFA · DCMFE · DCNI
GrowSpecialise
Malware, cloud, drones, crypto tracing, OSINT or AI forensics.
Malware Reverse Engineering Cryptocurrency / Blockchain Forensics OSINT / Open Source Intelligence