Digital Forensics (DFIR)
Reconstructing what happened from evidence — execution artifacts, registry, event logs, filesystem metadata, memory and network traces — into a defensible timeline and report. Recommended prior knowledge: Cyber Foundations or Incident Response.
What you will be able to do
- Preserve evidence integrity and choose the right acquisition for the situation.
- Correlate execution, registry, event-log, filesystem, memory and network artifacts into one defensible timeline.
- Scope an incident from artifacts and deliver findings a responder and an executive can act on.
Units
- 01
Forensic Foundations & Evidence Integrity
What forensics is, DFIR vs incident response, evidence integrity and hashing, chain of custody, acquisition choices, and the order of volatility.
BeginnerAvailableWhy you are learning this
Every later finding is only as strong as how the evidence was handled — this module builds the discipline the whole path stands on.
- 02
Execution & User Artifacts
Windows artifacts as witnesses: Prefetch, Amcache, Shimcache, LNK files, Jump Lists, browser and download history, shell history.
BeginnerAvailableWhy you are learning this
"Did it run, and who ran it?" is the question most investigations turn on. This module teaches the artifacts that answer it.
Unit contents7
Theory Lessons(6)
Practical Labs(1)
- 03
Registry, Persistence & Event Logs
The registry as evidence, Run keys, services and scheduled tasks, UserAssist, Windows Event Logs for forensics, Sysmon and PowerShell logging.
BeginnerAvailableWhy you are learning this
Persistence is where intrusions live between reboots. Finding it in the registry and event logs turns a suspicion into a case.
Unit contents7
Theory Lessons(6)
Practical Labs(1)
- 04
Filesystem & Timeline Analysis
NTFS and the MFT, timestamps and MACB, deleted files, Recycle Bin and the USN Journal, timeline reconstruction, and Linux artifacts.
Job-ReadyAvailableWhy you are learning this
The timeline is the deliverable of forensics: this module teaches assembling one from filesystem truth — and knowing when timestamps lie.
Unit contents7
Theory Lessons(6)
Practical Labs(1)
- 05
Memory & Network Evidence
Memory forensics fundamentals: processes and lineage, sockets, modules, injected-code awareness, credential handling, and correlating host evidence with DNS and network logs.
Job-ReadyAvailableWhy you are learning this
What only lives in memory — and what the network saw — closes the gaps disk artifacts leave. This module extends the case beyond the disk.
- 06
Scoping, Reporting & the Manara Case
Turning findings into incident scope, IOC extraction and ATT&CK mapping, the forensic report, the tool landscape, anti-forensics awareness — and the integrated Manara capstone.
Job-ReadyAvailableWhy you are learning this
An investigation that never becomes a scoped, written, defensible finding changed nothing. This module closes the loop — then proves it on a full case.
Unit contents7
Theory Lessons(6)
Practical Labs(1)
Recommended next
Malware Analysis
Understanding suspicious samples defensively — safe handling, static and dynamic analysis, behavior, persistence, network activity — and turning what a sample DOES into IOCs, ATT&CK mappings and detections. Recommended prior knowledge: Cyber Foundations or Digital Forensics.
Incident Response
Move from a confirmed alert into structured response: validate, scope, preserve evidence, contain, eradicate, recover — and report to both engineers and executives. Recommended prior knowledge: Cyber Foundations or SOC Analyst L1.