A digital forensics analyst finds, preserves and explains digital evidence, so a court, a lawyer or an incident response team can trust it. The work is part IT detective, part careful record-keeper, part writer. You do not need to be a genius hacker. You need to be methodical, curious and honest. This roadmap takes you from computer and network basics, to the core forensic workflow (acquire, preserve, analyze, report), to specialized work in memory, cloud and mobile. Everything uses free tools and free learning. Most hiring is in federal and state law enforcement, defense contractors, consulti
See the full roadmap free
Every stage from beginner to expert, with lessons, practice drills, projects, interview questions and free resources. Free with a Rolearch account.
Stage 1 of 3 · about 12 weeks
Understand how computers, file systems and networks store and move data, and learn the forensic principles that make evidence trustworthy.
Operating systems and command line
Evidence lives inside operating systems. If you know where Windows, Linux and macOS keep user activity, logs and settings, you know where to look. The command line is also how you verify hashes, search files and automate tasks.
Networking fundamentals
Most intrusions leave network traces. You need to read an IP address, a DNS lookup and a TCP handshake, because incident cases revolve around who talked to whom and when.
File systems and data structures
Deleted files, hidden data and timestamps make sense only when you know how NTFS, FAT, ext4 and APFS work. A file's name is not the file. Its content, metadata and location on disk are separate things.
Forensic principles, law and chain of custody
A technically perfect finding is useless if the evidence was mishandled. Courts ask: was it preserved, was it altered, and can you show who held it? Knowing the law keeps your work admissible and keeps you out of trouble.
Scripting basics with Python
You will often need to parse thousands of log lines or hash many files. A little Python turns hours of clicking into minutes, and it is the language most forensic tools extend.
Then 2 more stages (about 48 weeks in all) with lessons, drills, projects, 6 interview questions with strong answers and free resources.