[rasc0]

Hi everyone, I'm new to the community. I'm majoring in Cybersecurity and I want to specialize in Computer Forensics. I have a basic understanding of networking but zero experience in forensics. I was wondering if someone could give me a study roadmap or recommend some essential tools/books to get started. I'm eager to learn. Thanks in advance

[DramaKing]

You don't have enough to study?

[cl0udzz]

The first question here should be what type of forensics, I'm gonna assume your interested in computer forensics, if that's the case I would focus on learning common encryption methods, how metadata works, not just for images but also for other type of files and on top of that just try to learn as much as you can.

[12351123df]

Tools to consider and learn: FTK Imager, Autopsy, Volatility

Question is too vague. Need more info to be helpful.

[Vladimir_Belyakov]

If this is still on your mind, I can recommend platforms and courses, as well as offer some advice on learning this field. I’ve only been at it for a year myself, but I’ve successfully investigated real-world incidents.

---

Study network traffic.

Work with:
Wireshark/tshark
Volatility
FTK Imager
RegRipper
Registry Explorer

Also, pay close attention to logging.

Learn how logging works, how to read logs, and so on.

For logs, I recommend looking into:
Hayabusa
Chainsaw
Sysmon

---

It is also necessary to study operating systems—how they work and what their file structures are—and to pay special attention to DLLs.

This is because attacks are often carried out precisely through them.