InternshipAll 30 tasks, level by level
The real graded Digital Forensics tasks the portal assigns, grouped into three levels.
The portal assigns these Digital Forensics tasks. Finish Level 1 before Level 2 and Level 2 before Level 3. Your mentor may mark some tasks as required for the certificate.
Level 1: Foundations (12 tasks)
| Task | What to do |
|---|---|
| What digital forensics is | In a repo named forensics-internship, explain digital forensics, its stages (identify, preserve, analyse, report) and where it is used in India (police, courts, companies). |
| Law and ethics | Explain the IT Act, the Bharatiya Sakshya Adhiniyam rules on electronic evidence (certificate under section 63), consent, and why you only examine data you are allowed to. |
| Chain of custody | Create a chain-of-custody form and fill it in for a practice USB drive you own. |
| Hashing for integrity | Hash files with MD5 and SHA-256, change one byte and show the hash change, and explain why hashes prove evidence was not altered. |
| Disk imaging | Make a forensic image of a small USB drive you own with FTK Imager or dd, and verify its hash. |
| Filesystems | Explain FAT32, NTFS and ext4, and how deleted files can sometimes be recovered. |
| Autopsy basics | Load a public practice disk image (for example from the NIST CFReDS project) into Autopsy and list its files, users and timeline. |
| File signatures | Identify files whose extensions were changed by reading their header bytes with a hex editor. |
| Metadata | Extract metadata from photos and documents you own with ExifTool and explain what it reveals (camera, time, location). |
| File recovery | Recover deleted test files from your own USB drive with PhotoRec or Autopsy and record what came back. |
| Windows artefacts | On your own Windows VM, find recent files, USB history, prefetch and browser history, and explain what each shows. |
| Report writing basics | Write a one-page practice report: case details, evidence, tools, findings and hashes. |
Level 2: Building real features (10 tasks)
| Task | What to do |
|---|---|
| Timeline analysis | Build a timeline of events from a practice image using Autopsy or plaso and explain the sequence. |
| Registry analysis | Analyse registry hives from a practice image with Registry Explorer or RegRipper and find installed programs and connected devices. |
| Browser forensics | Analyse browser history, downloads and cookies from a practice image and present the findings. |
| Email forensics | Analyse headers of sample emails to trace the sending path and spot forged senders. |
| Memory forensics | Analyse a public practice memory image with Volatility 3: processes, network connections and command lines. |
| Mobile forensics basics | Explain Android and iOS evidence sources and examine a public practice Android image or your own phone backup with ALEAPP. |
| Log analysis | Investigate Windows event logs and Linux auth logs from a practice dataset to find a suspicious login. |
| Network forensics | Analyse a public practice PCAP in Wireshark and reconstruct what happened (files transferred, sites visited). |
| Steganography check | Detect hidden data in practice images with steganalysis tools and explain how investigators look for it. |
| Practice challenge | Solve a beginner digital forensics challenge from a public training platform (CyberDefenders or similar) and write your method. |
Level 3: Professional work and capstone (8 tasks)
| Task | What to do |
|---|---|
| Full case investigation | Investigate a complete practice case image end to end: preserve, hash, analyse files, registry, browser and logs, and build a timeline. |
| Expert-style report | Write a professional forensic report for the case: summary, evidence list with hashes, method, findings, timeline and conclusion. |
| Cloud evidence | Explain how evidence is collected from cloud services (account logs, legal requests) and review audit logs from your own free cloud account. |
| Incident response link | Explain how forensics supports incident response and CERT-In reporting, using your case as an example. |
| Tool comparison | Compare 3 free forensic tools on the same practice image: features, speed and accuracy. |
| Automation | Write a Python script that hashes a folder of evidence files and produces a CSV inventory. |
| Certification prep | Make notes and 30 practice questions on digital forensics fundamentals for an entry-level certification. |
| Capstone: forensics portfolio | Publish your lab work: chain-of-custody forms, 3 practice case reports, a timeline and your scripts. Submit the repo and a 2-minute video walkthrough. |