Network & Cloud Forensics
Traffic, logs, cloud accounts and virtual environments
Most crimes and breaches today leave their clearest marks outside the suspect's own computer. A phishing link shows up in proxy logs. A stolen file leaves as a burst of outbound traffic. A mailbox is read from an IP address in another country and the only record sits in a cloud audit log. This track teaches you to find, preserve and explain that kind of evidence.
The four courses move from the wire to the cloud. You start with traffic and log analysis, learn Wireshark properly, then work with AWS, Microsoft 365 and Google Workspace records and finish with virtual machines and hypervisors. The work is done in the DFRTI Network and Cloud Forensics Lab, which is set up for traffic capture, packet analysis and virtualised environments.
Courses in Network & Cloud Forensics
Open a course to see the full syllabus, labs, tools and who it suits.
- 01
Network Traffic AnalysisRead flows, logs and packets to trace intrusions, beaconing and data theft. - 02
Wireshark / Packet CaptureCapture, filter and read packets in Wireshark and tshark to recover what was sent. - 03
Cloud Storage InvestigationCollect and read AWS, Microsoft 365 and Google Workspace logs as sound evidence. - 04
Virtual Machine / Hypervisor ForensicsExamine VMDK, VHDX and QCOW2 disks, snapshots, ESXi logs and VM memory files.
Need help picking a course in Network & Cloud Forensics?
Tell us your background and what you want to do next. A counsellor will suggest a course and the next batch.