Imagine you are the engineer on call at HarborView Credit Union, a 1,200-employee organization. A finance laptop, FIN-LT-033, is acting strangely. Your first instinct is to reboot it or run a cleanup tool. That instinct is the most common way evidence gets lost.
Digital forensics is the practice of collecting and analyzing digital evidence so that others can check your conclusions. This course teaches that practice for Windows systems, ending with findings mapped to MITRE ATT&CK, a public catalog of attacker tactics and techniques.
Every investigation in this course follows the same path. Each stage depends on the one before it, and a mistake early on carries forward. Here is the path for the HarborView laptop:
Evidence is more than a file or a log line. It is an artifact (something the system recorded or left behind), plus a record of how you obtained it, plus the ability for someone else to repeat your steps and reach the same result.
A claim such as “this laptop ran malware” is only a claim until it points to evidence a reviewer can check. The record of who handled the evidence, when, and where it was stored is called the chain of custody. If a link is missing, the evidence can be challenged, even when the artifact itself is real.
Here is a made-up ticket note from the HarborView SOC lead for this case: