Welcome: Dr. Tahseen Al-Doori's IT Forensics Essentials

What you'll be able to do

By the end of this lesson you will be able to describe who wrote the book this course is built on, how the course follows its fourteen chapters, and why some practice has been updated for 2026.

• Name the author and the book, and explain what the book sets out to do.
• Find your way around the course: parts, lessons, checkpoints and capstones.
• Explain what a "From the Book to 2026" section is, and why it exists.

Meet the Author and His Book

This course is built on IT Forensics Essentials: Concepts, Tools, and the Practice of Digital Investigation by Dr. Tahseen Al-Doori, B.Eng. (Hons), M.Sc., PGCE, Ph.D., FBCS, MCP, CCNA. Dr. Al-Doori is an academic, researcher and consultant whose work spans IT security, networking and wireless communications, with more than 35 years at the meeting point of education and technology. Everything you study here follows his book: its order, its chapters and its way of thinking about evidence.

The book is an overview of IT forensics: the concepts, tools and processes that digital forensic investigators use to gather and analyze evidence for legal purposes. It takes you from first principles (what digital forensics is, and how computers figure in crime) through the technical foundations of hashing, hexadecimal and storage hardware, into acquisition and analysis, and finally to the professional world: incident response, ethics, laboratory design, court reporting and landmark real-life cases.

If you have taken Cyber Security Essentials, Dr. Al-Doori's earlier book and course, you met forensics in its final unit. This course goes much further. You do not need that course first, but it is a helpful companion.

The Book's Fourteen Chapters, in Seven Parts

Dr. Al-Doori's fourteen chapters follow one arc: understand what forensics is, learn the technical foundations, master the techniques, act with integrity, apply it all in real investigations, work as a professional, and learn from history. The course keeps his order exactly and groups the chapters into seven parts. After this Orientation, each module is one part, and the course ends with a Capstone.

• Part I — Foundations of Computer Forensics (Chapters 1–2). What computer forensics is, who becomes an investigator, how computers figure in crime and the four stages from crime scene to courtroom.
• Part II — The Technical Foundations (Chapter 2). Hash values, hexadecimal and file signatures, how storage devices hold data, where evidence hides in Windows, and a first look at FTK Imager.
• Part III — DFIR, Services and Techniques (Chapters 3–5). Digital forensics and incident response, the services investigators provide, and the core techniques: acquisition, data recovery, timelines, logs, passwords, encryption and email.
• Part IV — Integrity (Chapters 6–8). The ethics of forensic science, write-blockers, and the vocabulary of security told through two true stories.
• Part V — Forensics in Practice (Chapters 9–11). Realistic investigation scenarios, a full forensic software suite, and three business use cases.
• Part VI — Professional Practice (Chapters 12–13). How a forensic lab is built and run, and how to write a court report and give testimony.
• Part VII — Landmark Cases (Chapter 14). Ten real cases, from the BTK killer to the San Bernardino iPhone, and the techniques that solved them.

Every lesson tells you which chapter it follows, so you can always connect what you are learning back to the book.

Why Some Practice Has Been Updated for 2026

Digital forensics moves with technology. New devices appear, operating systems change how they store data, and standards are revised. A book's foundations can stay completely sound while some of its details need refreshing, and that is the situation here. The book's core ideas are as true as ever: never work on the original, prove integrity with a hash, keep a chain of custody, stay within your authority and report only what the evidence supports. What has moved on is some of the detail around them. Three examples you will meet later:

• Hash algorithms. In 2017 researchers at CWI Amsterdam and Google produced the first practical collision for SHA-1, two different files with the same SHA-1 value. NIST has since announced that SHA-1 will be retired by the end of 2030. SHA-256 is now the sensible default for proving integrity.
• Encryption by default. Microsoft documents that, starting with Windows 11 version 24H2, many more devices qualify for automatic device encryption. Phones are encrypted by default too. This changes one of the first decisions at a scene: whether to switch a running device off.
• Incident response. In April 2025 NIST replaced its well-known incident response guide with Revision 3, which organizes incident response around the six functions of its Cybersecurity Framework 2.0.

So that you always see both the book's teaching and today's practice, many lessons include a section called From the Book to 2026. It follows the same four steps every time: what the book teaches, why that made sense, what has changed since, and what to do now, with the official source that supports the update. The book is the starting point; the 2026 section shows how practice has evolved from it.

How This Course Works

Lessons. Each lesson opens with a "Where you are" note and a short list of what you will be able to do. Then come the teaching sections, a real-world example and, in many lessons, the From the Book to 2026 section. Many lessons include a short video. The video is a complement: every lesson is complete without it. Each lesson ends with a "What Would You Do?" scenario, a short knowledge check with explained answers, key takeaways and the sources behind every fact.

Hands-on activities. A few lessons invite you to try free tools on your own computer: calculating a hash, viewing a file in hexadecimal, imaging your own USB stick and opening a public practice case. These are always optional, and each one has a reading-only alternative.

Checkpoints. At the end of each part, a checkpoint gives you three realistic scenarios. You choose what to do, then compare your choice with a model answer. Checkpoints test judgment, not memory.

Capstones. The course ends with two projects and a final self-assessment. Capstone A is an evidence lab: you hash, image and examine practice evidence, then keep a proper evidence log. Capstone B is a fictional intellectual-property theft case: you build a timeline, decide what the evidence can and cannot prove, and write a full court-style report. The final self-assessment has 20 scenario-based questions.

Self-checks, not exams. Every quiz in this course is a self-check. You choose an answer and press Check, and the page tells you at once whether you were right and highlights the correct option. Nothing is recorded, scored or sent to the Academy: the checks are for your learning, not for a grade. The capstones work the same way: you compare your own work with a rubric and a model solution.

How long it takes. These are estimates. They assume reading at about 170 words a minute and include the videos, whose lengths vary, and the checks. Your own pace will differ.

Authority, Privacy and Ethics

Forensics is powerful, which is exactly why it has rules. Two apply throughout this course.

First, authority: investigators examine devices and data only under proper legal authority, such as a warrant, a court order, or the documented permission of the organization that owns the system. The same applies to you as a learner. Only examine devices, accounts and systems you own or are explicitly authorized to work with. All practice in this course uses your own device or public, fictional training data.

Second, privacy: no activity, quiz or capstone will ever ask you to share real passwords, personal files, photos, messages, account names or screenshots of your own devices. You keep your practice private.

Real-World Example

Here is a preview of one of the book's landmark cases. Between 1974 and 1991, a serial killer in Wichita, Kansas, who called himself BTK murdered ten people. He taunted police with letters in the 1970s and again from 2004, and evaded capture for about three decades. In early 2005 he sent a floppy disk to a local television station, having been led to believe a floppy could not be traced. Investigators examined it and found a deleted document. Its metadata, the hidden information a program stores about a file, named "Christ Lutheran Church" and showed the document had last been saved by a user called "Dennis". The church council's president was Dennis Rader. DNA evidence then linked him to the crimes, and he was arrested in February 2005.

The disk did not contain a confession. It contained a few words of metadata that the author never knew were there. You will take this case apart in Part VII, along with nine others.

What Would You Do?

Before you move on, take one minute to reflect privately. Think of a file you created recently, such as a document, a photo or a spreadsheet. What could it reveal about you that you did not type into it? Who created it, on which device, when, and perhaps where? You do not need to check or share anything. Keep the question in mind: by the end of Part II you will know where to look.

Knowledge Check

There is no quiz in this orientation lesson. Your first check, an ungraded forensic instincts check, comes in the next lesson.

Key Takeaways

• This course is built on IT Forensics Essentials by Dr. Tahseen Al-Doori and follows his fourteen chapters, in his order, grouped into seven parts.
• The book's core principles still hold. "From the Book to 2026" sections start from the book's teaching and show how current practice has developed from it.
• Videos and hands-on activities are optional complements; every lesson is complete on its own.
• Only examine devices, accounts and systems you own or are explicitly authorized to work with.

Sources

• Dr. Tahseen Al-Doori — IT Forensics Essentials: Concepts, Tools, and the Practice of Digital Investigation, About the Author, About This Book and Contents
• CWI Amsterdam and Google — SHAttered: the first SHA-1 collision (2017)
• NIST — NIST Retires SHA-1 Cryptographic Algorithm (December 2022)
• Microsoft Learn — BitLocker overview: device encryption
• NIST — SP 800-61 Rev. 3: Incident Response Recommendations and Considerations for Cybersecurity Risk Management (April 2025)
• Lawrence Journal-World (Associated Press) — Computer disk, DNA and messages helped lead police to BTK suspect (4 March 2005)
• NBC News — Computer disk may have cracked BTK case (2005)
• Berkeley Research Group — David Kalat, Nervous System: How Legal Tech Helped Catch the BTK Killer (October 2019)
• Oxygen — How a floppy disk exposed Dennis Rader as the BTK killer