Skip to main content
Log in

Digital Forensics & Incident Response

Learn to run an incident the way a government CSIRT does: follow the NIST incident response lifecycle, handle evidence so it survives scrutiny, and reconstruct what happened from Windows, Linux and memory artifacts. Five labs take you from a first timeline to a full incident-response tabletop.

Digital Forensics & Malware Analysis
Level
Intermediate
Study time
9 hours
Lessons
5
Practice labs
5
Assessments
2
Format
Self-paced, online

What you will learn

By the end of this course you will be able to:

  • Describe the NIST SP 800-61 incident response phases and state which actions belong to each
  • Apply the order of volatility and chain-of-custody rules to a seized device
  • Verify evidence integrity with cryptographic hashes and explain why it matters for admissibility
  • Correlate Windows, Linux and filesystem artifacts into a single UTC timeline
  • Identify persistence in Run keys, scheduled tasks and cron from a listing
  • Choose and justify containment actions that stop an attacker without destroying evidence

Before you start

Comfortable reading Windows and Linux logs; networking basics (IP, DNS, HTTP); path courses on log analysis recommended.

Tools you will use

  • Timeline analysis
  • Hashing (sha256sum / Get-FileHash)
  • Windows Event Viewer
  • Autoruns-style listings
  • Simulated forensic console

Course outline

5 lessons in 2 modules.

Module 1: Incident response and evidence handling

  • The incident response lifecycle
  • Evidence handling and chain of custody

Module 2: Artifacts and timelines

  • Order of volatility and memory evidence
  • Windows artifacts and persistence
  • Linux artifacts and building timelines

Practice labs and assessments

Labs run in the browser as simulations. They never touch a real system.

5 practice labs

  • Build a timeline from mixed artifacts Beginner, 35 min
  • Chain-of-custody form review Beginner, 25 min
  • Forensic console: triage a disk image Intermediate, 35 min
  • Persistence hunt: autoruns listing Intermediate, 30 min
  • Tabletop: ransomware precursor at the Ministry Advanced, 50 min, final lab

2 assessments

  • DFIR knowledge check
  • DFIR final quiz

The pass mark is 70%. You can retake an assessment.

Take Digital Forensics & Incident Response

Request access and your instructor will set up your account.

Log in