# Digital Forensics and Incident Investigation for Federal Employees Course Canonical URL: ## Overview This course builds what federal employees need in order to conduct sound digital forensics and incident investigations — not merely to establish that something happened, but to prove what, when, and how, defensibly. It is organized around the NIST SP 800-86 forensic process (Collection, Examination, Analysis, Reporting) and integrates IOC investigation, chain of custody, and the federal legal and oversight framework: the Federal Rules of Evidence, OIG and counsel coordination, ISO/IEC 27037 and 27041-43, and SWGDE. A full capstone investigation closes the course, worked through with the instructor. Completing it also credits toward the Digital Forensics & Incident Response certificate, which in turn rolls up into the Cyber Operations Professional credential. ## What you'll learn - Apply the NIST SP 800-86 forensic process and tie it back to the NIST SP 800-61 IR lifecycle. - Recognize the legal and policy foundations for federal digital evidence, and know the point at which to refer a matter to OIG, counsel, or law enforcement. - Collect and preserve evidence in order of volatility — memory, disk, network, cloud — without contaminating it. - Work IOCs across host, network, and behavioral data to establish scope and assemble a timeline. - Reconstruct timelines and correlate artifacts, with a clear sense of the limits of what forensic evidence can prove. - Hold a defensible chain of custody and write findings that land with technical, executive, and legal readers. ## Curriculum #### Module 1 The Importance of Forensics & Investigation #### Module 2 Federal Forensic Standards & Legal Foundations #### Module 3 Forensic Readiness & Evidence Handling #### Module 4 Evidence Collection & Acquisition #### Module 5 Indicators of Compromise: Identification & Analysis #### Module 6 Forensic Analysis Techniques #### Module 7 Investigation Documentation, Reporting & Chain of Custody #### Module 8 Best Practices, Quality Assurance & Capstone Investigation (75m) ## Schedule - Dec 1, 2026 – Dec 2, 2026 — Live Online - Jan 28, 2027 – Jan 29, 2027 — Live Online - Feb 22, 2027 – Feb 23, 2027 — Live Online - Mar 4, 2027 – Mar 5, 2027 — Live Online - Apr 23, 2027 – Apr 26, 2027 — Live Online - May 27, 2027 – May 28, 2027 — Live Online - Jun 11, 2027 – Jun 14, 2027 — Live Online - Jul 14, 2027 – Jul 15, 2027 — Live Online ## Instructors ### Wes Bryan — Instructor Wes Bryan resides in Gainesville, Florida, and has built his career around technology, education, and helping others understand complex subjects. He values continuous learning, clear communication, and practical problem-solving. Outside of work, Wesley enjoys running, hiking, fishing, and spending time outdoors. He also has a strong interest in music and literature, enjoys reading both fiction and nonfiction, as well as playing guitar. ### Chuck Moore — Instructor With more than 25 years of experience in IT and cybersecurity, Chuck has built a career on a strong foundation in security, networking, help desk operations, and technical training. He has helped organizations strengthen their security posture by identifying vulnerabilities, conducting threat assessments, implementing security controls, and ensuring compliance with industry standards. Combining extensive technical expertise with a passion for education, Chuck equips professionals with the knowledge and practical skills needed to recognize risks, risks and respond effectively. ## Pricing **Tuition:** $1049