├── Cyber Forensics Roadmap
│
│ ├── Foundations
│ │ ├── Networking Basics (TCP/IP, OSI Model, DNS)
│ │ ├── Operating Systems (Windows, Linux)
│ │ ├── File Systems (NTFS, FAT32, EXT4)
│ │ └── Programming & Scripting (Python, Bash)
│
│ ├── Digital Evidence
│ │ ├── Evidence Collection & Chain of Custody
│ │ ├── Disk Imaging (FTK Imager, dd)
│ │ ├── Write Blockers & Data Integrity
│ │ └── Legal Considerations & Compliance
│
│ ├── Forensic Tools
│ │ ├── Autopsy / Sleuth Kit
│ │ ├── EnCase / FTK
│ │ ├── Volatility (Memory Analysis)
│ │ └── Wireshark / NetworkMiner
│
│ ├── Analysis Techniques
│ │ ├── File Carving & Metadata Analysis
│ │ ├── Registry & Log Analysis (Windows)
│ │ ├── Timeline Reconstruction
│ │ └── Email & Browser Artifact Analysis
│
│ ├── Memory Forensics
│ │ ├── RAM Dumping & Analysis
│ │ ├── Malware Detection in Memory
│ │ └── Volatility Plugins & YARA Rules
│
│ ├── Mobile Forensics
│ │ ├── Android & iOS Data Extraction
│ │ ├── SIM & SD Card Analysis
│ │ └── Tools: Cellebrite, MOBILedit, Magnet AXIOM
│
│ ├── Network Forensics
│ │ ├── Packet Capture & Analysis
│ │ ├── Intrusion Detection Logs
│ │ └── Correlation with Host Artifacts
│
│ ├── Malware Analysis
│ │ ├── Static & Dynamic Analysis
│ │ ├── Sandboxing & Reverse Engineering
│ │ └── Tools: Ghidra, IDA Pro, Cuckoo Sandbox
│
│ ├── Reporting & Documentation
│ │ ├── Incident Timeline & Findings
│ │ ├── Risk Assessment & Recommendations
│ │ └── Legal-Ready Reports & Presentation
│
│ └── Certifications & Career
│ ├── CHFI (Computer Hacking Forensic Investigator)
│ ├── GCFA (GIAC Certified Forensic Analyst)
│ ├── CCE (Certified Computer Examiner)
│ └── DFIR Career Paths (Law Enforcement, Corporate, Freelance)

نقشه راه جرم شناسی سایبری ( فارنزیک) 🚨