Welcome. Imagine two people doing the same thing: copying a file from a company computer to a USB stick. The first does it by dragging it with the mouse, because they need it to understand something. The second calculates a hash value of the medium, connects a device that prevents any writing, produces a complete copy, recalculates the hash value, compares it, notes the time, the serial number, who was present and why they decided to proceed that way.

The file is identical. The evidence is not. The first copy, in the face of a serious challenge, proves nothing: it cannot be ruled out that the content has changed, nobody knows who has had it in their hands, it cannot be redone. The second holds, and not because of the tool used - any serious program calculates the same value - but because of what surrounds it.

This path teaches what surrounds it. It is the discipline that in Italian is called informatica forense and in English digital forensics: the body of methods that makes it possible to say, with a declared and verifiable degree of certainty, what happened on a computer system.

A single question runs through the whole path, and it is the one by which every choice is judged: if someone challenged this step, what would I have to show them? The international standards of the ISO/IEC 27037 family give that question an operational form in four properties: the work must be auditable (there is a trace of what was done), repeatable (I redo it and get the same), reproducible (someone else redoes it with other means and gets the same) and justifiable (every choice has a declared reason). These are four words that come back in every module of the path, because they are the criterion, not an introduction.

It is not a path for specialists only. Most digital evidence is compromised in the first hours, by competent people who are trying to do the right thing: they reboot to restore the service, they open files to understand, they reinstall the machine to get back to work. Knowing what not to do, and why, is worth more than any tool bought afterwards.

Path objectives

By the end of the path you will be able to:

• distinguish copied data from usable evidence, and explain what the difference consists of using the four properties - auditability, repeatability, reproducibility, justifiability - that international standards require (Module 1);
• place the work within the legal framework in which it takes place, know which rules impose technical measures against alteration of data and recognise the boundary between an internal investigation and criminal proceedings, which changes who decides and what can be done (Module 1);
• set the order of acquisition operations starting from the volatility of the sources, choose between live and dead acquisition and justify the choice, and understand what write blocking is really for (Module 2);
• produce and verify a forensic copy, use hash functions knowing what they show and what they do not show, and decide when a selective acquisition is more defensible than a full one (Module 2);
• keep a chain of custody that withstands a challenge, use time stamping and electronic seals to anchor evidence in time, and show that the method adopted was fit for purpose (Module 3);
• conduct an analysis through verifiable hypotheses rather than through confirmations, build a reliable timeline, recognise concealment techniques and distinguish in a report what the data proves from what is an interpretation (Module 4);
• deal with cases in which the medium cannot be taken - cloud services, mobile devices, ephemeral containers, industrial systems - knowing which legal and technical instruments exist and what limits they have (Module 5);
• write the technical report that closes the work, handle the personal data that the investigation inevitably encounters according to the rules that protect them, and hold together the timescales of the analysis with the tighter ones of the notification obligations (Module 6).

Who it is for and prerequisites

The path is for those who may have to explain, with proof, what happened: cybersecurity specialists and managers, members of incident response teams, system and network administrators, IT managers of organisations that do not have a dedicated team, DPOs and privacy contacts, compliance managers and NIS contacts, internal audit staff, technical consultants.

Prerequisites. No experience in digital forensics is needed: the path builds it from scratch. What is needed is a basic familiarity with operating systems, networks and the concepts of risk and incident, which Information Security Fundamentals provides. It is strongly recommended to have taken Incident Management and Response first, which this path borders on and complements: that one teaches how to regain control, this one teaches how not to destroy, along the way, what will be needed to understand and to prove.

A clarification on scope, which is also a warning. This path teaches the method: what must be done, in what order, with what guarantees and with what documentation. It does not qualify you to carry out technical examinations in criminal proceedings, which in Italy are carried out by consultants and experts appointed by the judicial authority or by the parties, in the forms and with the guarantees of the Code of Criminal Procedure, and it does not replace legal advice, which must be sought whenever a fact may have criminal or disciplinary relevance. Nor does it teach how to access other people's systems or data: every activity described presupposes a legitimate mandate, and Module 1 explains how to verify that you have one.

Format

The path is delivered entirely online, asynchronously: you can study when you want, at your own pace, from any device. The estimated total duration is 26 hours, to be spread within the completion deadline set out below.

Every module has the same three-step structure:

1. Lesson. A reasoned treatment of the topic, with diagrams, examples and concrete cases.
2. Test. Closed-answer questions on the whole module. Passing requires at least 70%; attempts are unlimited and the best mark counts. At the end of every attempt you receive a detailed explanation of each answer, including the correct ones.
3. Exercise. A case to work through by deciding: every choice opens a different path and the outcome depends on what you chose, with an explanation of what would have happened otherwise. Marking is automatic and you can retake it as many times as you like.

Progression. The 6 modules are taken in sequence: each module unlocks only after you have passed the previous module test. The exercises do not block progress, but they are an integral part of the path and of the overall assessment.

Final test and certificate

Once you have passed the tests of all the modules, the final test unlocks: 30 questions drawn at random from the topics of the whole path, with the same 70% threshold. You have three attempts, at least one week apart: if none of them reaches the threshold, the path starts again from the first module. On passing it you obtain the path certificate, downloadable as a PDF, with a unique code that allows its authenticity to be verified.

Warning

The content is up to date as of October 2026. Four warnings specific to this subject.

The first, on technical standards. The ISO/IEC standards cited in the path are paid-for documents protected by copyright: the path explains their principles, structure and requirements in its own words and with original examples, but does not reproduce their text. To declare conformity with any of them you must obtain the current edition.

The second, on the law. Procedural rules change, and they change by country. The path describes the Italian and European framework and does so citing sources, but no course replaces the advice of someone who practises that law. Faced with a fact that may be criminally relevant, the first decision is not technical: it is to call the right people.

The third, on tools. The path names categories of tools and not products. It is not a commercial caution: a tool is chosen after the method has been defined and its suitability for the purpose has been verified, and a path that started from the tools would teach the wrong order. The command examples are there to show what an operation does, not to be copied onto a real system.

The fourth concerns cases. The scenarios and numerical values used in the examples are realistic but remain examples. The real-world cases cited are verified at source and linked: in this field very widespread and very wrong reconstructions circulate, and repeating them in a report is the quickest way to lose credibility.

Support

In the Announcements forum you will find the trainer's messages. For questions about the content or the exercises, use the channels indicated by your training contact.