RGI Cyber Security Institute

Internet Forensics

This module will enable students to develop the necessary knowledge and skills for the recovery of admissible evidence from computers which have been used to access or exchange data across the Internet.


On successful completion of this module a student should be able to:

  • Explain the function and operation of common Internet protocols
  • Interpret evidence recovered from the use of Web browsers
  • Debate the attribution and reliability issues of Internet-derived evidence
  • Illustrate the ability to recover evidence from Internet transactions.
  • Syllabus

  • Internet history, addressing and services, including the role of Internet authorities and registries
  • Internet architecture and protocols
  • IP addresses and domains
  • Web browser architectures and data
  • SQLite database binary analysis and query structure
  • ESE and index.dat data storage
  • Web server administration forensics
  • Social network artefacts
  • Email
  • Internet-specific crime.
  • Copyright © RGI Cyber Security Institute