Digital Forensics Internship
Learn how investigators examine digital evidence: chain of custody, hashing, disk imaging, file recovery, Windows, browser, email, memory and network artefacts, timelines and court-style reports, using only public practice images and your own devices.
What you'll work on
- Level 1: Foundations - What digital forensics is, Law and ethics, Chain of custody and more
- Level 2: Building real features - Timeline analysis, Registry analysis, Browser forensics and more
- Level 3: Professional work and capstone - Full case investigation, Expert-style report, Cloud evidence and more
Full syllabus: all 30 graded tasks
These are the actual tasks the internship portal assigns for this domain. You submit each one with proof (a GitHub link or document) and a mentor reviews it.
Level 1: Foundations (12 tasks)
- What digital forensics is. In a repo named forensics-internship, explain digital forensics, its stages (identify, preserve, analyse, report) and where it is used in India (police, courts, companies).
- Law and ethics. Explain the IT Act, the Bharatiya Sakshya Adhiniyam rules on electronic evidence (certificate under section 63), consent, and why you only examine data you are allowed to.
- Chain of custody. Create a chain-of-custody form and fill it in for a practice USB drive you own.
- Hashing for integrity. Hash files with MD5 and SHA-256, change one byte and show the hash change, and explain why hashes prove evidence was not altered.
- Disk imaging. Make a forensic image of a small USB drive you own with FTK Imager or dd, and verify its hash.
- Filesystems. Explain FAT32, NTFS and ext4, and how deleted files can sometimes be recovered.
- Autopsy basics. Load a public practice disk image (for example from the NIST CFReDS project) into Autopsy and list its files, users and timeline.
- File signatures. Identify files whose extensions were changed by reading their header bytes with a hex editor.
- Metadata. Extract metadata from photos and documents you own with ExifTool and explain what it reveals (camera, time, location).
- File recovery. Recover deleted test files from your own USB drive with PhotoRec or Autopsy and record what came back.
- Windows artefacts. On your own Windows VM, find recent files, USB history, prefetch and browser history, and explain what each shows.
- Report writing basics. Write a one-page practice report: case details, evidence, tools, findings and hashes.
Level 2: Building real features (10 tasks)
- Timeline analysis. Build a timeline of events from a practice image using Autopsy or plaso and explain the sequence.
- Registry analysis. Analyse registry hives from a practice image with Registry Explorer or RegRipper and find installed programs and connected devices.
- Browser forensics. Analyse browser history, downloads and cookies from a practice image and present the findings.
- Email forensics. Analyse headers of sample emails to trace the sending path and spot forged senders.
- Memory forensics. Analyse a public practice memory image with Volatility 3: processes, network connections and command lines.
- Mobile forensics basics. Explain Android and iOS evidence sources and examine a public practice Android image or your own phone backup with ALEAPP.
- Log analysis. Investigate Windows event logs and Linux auth logs from a practice dataset to find a suspicious login.
- Network forensics. Analyse a public practice PCAP in Wireshark and reconstruct what happened (files transferred, sites visited).
- Steganography check. Detect hidden data in practice images with steganalysis tools and explain how investigators look for it.
- Practice challenge. Solve a beginner digital forensics challenge from a public training platform (CyberDefenders or similar) and write your method.
Level 3: Professional work and capstone (8 tasks)
- Full case investigation. Investigate a complete practice case image end to end: preserve, hash, analyse files, registry, browser and logs, and build a timeline.
- Expert-style report. Write a professional forensic report for the case: summary, evidence list with hashes, method, findings, timeline and conclusion.
- Cloud evidence. Explain how evidence is collected from cloud services (account logs, legal requests) and review audit logs from your own free cloud account.
- Incident response link. Explain how forensics supports incident response and CERT-In reporting, using your case as an example.
- Tool comparison. Compare 3 free forensic tools on the same practice image: features, speed and accuracy.
- Automation. Write a Python script that hashes a folder of evidence files and produces a CSV inventory.
- Certification prep. Make notes and 30 practice questions on digital forensics fundamentals for an entry-level certification.
- Capstone: forensics portfolio. Publish your lab work: chain-of-custody forms, 3 practice case reports, a timeline and your scripts. Submit the repo and a 2-minute video walkthrough.
Real software work, not just training
Every Digital Forensics task is reviewed by our team and saved to your portfolio. Interns who pass the readiness check can take real work from Training Trains, W3AppDevelopers and DomainHostly projects on the Company Work board.
Frequently asked questions
Do I need experience to join the Digital Forensics internship?+
Basic computer and networking knowledge helps. All work uses public practice evidence or devices you own.
What will I do in the Digital Forensics internship?+
You complete 30 graded tasks in three levels: foundations, real features, and professional work. Each task is submitted with GitHub or document proof and reviewed. The final capstone is: Capstone: forensics portfolio.
Do I get a certificate for the Digital Forensics internship?+
Yes. After your required tasks are approved, your attendance is above 75% and you pass the proctored final exam, you get a graded completion certificate that anyone can verify at trainingtrains.com/verify.
Can I do the Digital Forensics internship online?+
Yes. You can do it fully online from home, or offline at our Erode and Perundurai branches. Tasks, quizzes and mentor reviews are the same in both modes.
Available both online (work from home) and offline at our Erode and Perundurai branches - see the full internship program details for departments, duration, and the application process.