Digital Forensics & Incident Response (DFIR)
Reconstruct an intrusion after the fact — analyse a capture, an unknown binary and a persistence artifact you create in your own lab.
One-time payment · lifetime access · lessons, labs, exam and certificate included · no subscription.
About this course
This course introduces digital forensics and incident response through a hands-on investigation of harmless sample artifacts you create in your own lab. You begin with the order of volatility and the golden rule of hashing evidence and working only on copies. A disk-triage lesson uses timestamps to build a timeline, and a static-triage lesson shows how the strings command reveals a binary's embedded indicators such as a command-and-control address. You hunt persistence by recognising a suspicious scheduled task, and read a cleartext network capture to recover exposed credentials. A correlation lesson ties the artifacts together through a shared indicator of compromise, and a final lesson assembles everything into an incident report. Every lesson includes a quiz, with a final exam and certificate. All samples are inert and local.