Understand what forensic artifacts are present in the Windows and Linux Operating Systems, how to collect them, and leverage them to investigate security incidents.

Forensic artifacts are pieces of evidence left by human activity. In this module, we will learn about the forensic artifacts in Windows and Linux operating systems and perform basic malware analysis. We will learn to use Kape, Autopsy, Zimmerman’s tools, and Volatility to collect forensic data. We will also learn how to organize this data and leverage it to investigate incidents using the Hive project.

DFIR: An Introduction

Introductory room for the DFIR module

Windows Forensics 1

Introduction to Windows Registry Forensics

Windows Forensics 2

Learn about common Windows file systems and forensic artifacts in the file systems.

Linux Forensics

Learn about the common forensic artifacts found in the file system of Linux Operating System

Autopsy

Learn how to use Autopsy to investigate artefacts from a disk image. Use your knowledge to investigate an employee who is being accused of leaking private company data.

Redline

Learn how to use Redline to perform memory analysis and to scan for IOCs on an endpoint.

KAPE

An introduction to Kroll Artifact Parser and Extractor (KAPE) for collecting and processing forensic artifacts

Volatility

Learn how to perform memory forensics with Volatility!

Velociraptor

Learn Velociraptor, an advanced open-source endpoint monitoring, digital forensic and cyber response platform.

TheHive Project

Learn how to use TheHive, a Security Incident Response Platform, to report investigation findings

Intro to Malware Analysis

What to do when you run into a suspected malware.

Unattended

Use your Windows forensics knowledge to investigate an incident.

Disgruntled

Use your Linux forensics knowledge to investigate an incident.

Critical

Acquire the basic skills to analyze a memory dump in a practical scenario.

Secret Recipe

Perform Registry Forensics to Investigate a case.

Topic Rewind Recap

Lock in what you learned with a recap. Earn points and keep your streak.

Next steps

Phishing Analysis

Learn how to analyse and defend against phishing emails. Investigate real-world phishing attempts using a variety of techniques.

What are modules?

A learning pathway is made up of modules, and a module is made of bite-sized rooms (think of a room like a mini security lab).

Hierarchical diagram showing how learning pathways contain modules, which contain individual rooms.

Digital Forensics and Incident Response