DFIR
From your first case to working on your own.
A free course in Windows digital forensics and incident response (DFIR), from your first case to running an investigation on your own. Hands-on labs, exercises you can check, and Autopsy and Magnet tools.
Questions before tools
What happened, when and how. The question decides which evidence you open.
Evidence you do not change
Work on copies, hash everything and keep a chain of custody, from the first lesson.
Two tools that must agree
A finding counts when Autopsy and a second tool, Magnet or Eric Zimmerman’s, show the same thing.
Exercises you can check
You practise on activity you created yourself and on cases with published answers, so you know when you are right.
Windows DFIR from zero: the full syllabus
- Part 1Start
How an investigation works, and the lab you will practise in
Run an investigation as questions and evidence, handle evidence without changing it, build a safe lab and find activity you created yourself.
- Part 2Start
Collecting evidence without destroying it
Decide what to collect first, capture memory and a triage package, check for encryption, image a disk to E01 behind write protection and verify it with two tools.
- Part 3Coming next
Your first case in Autopsy, and the same case in Magnet Axiom
Open evidence, run ingest, search, tag, build a simple timeline and export a report, then compare two tools.
- Part 4Coming next
Proving a program ran
Read Prefetch, Amcache, Shimcache, BAM, UserAssist and SRUM, and say how strong each piece of evidence is.
- Part 5Coming next
Reading Windows event logs
Find logons and their types, new processes, services, scheduled tasks, cleared logs and PowerShell, and turn them into a timeline.
- Part 6Coming next
Finding persistence
Check run keys, services, scheduled tasks, WMI subscriptions and startup folders, and tell normal from planted.
- Part 7Coming next
What the user opened, browsed and plugged in
Use LNK files, Jump Lists, ShellBags, recent-file lists, browser history and USB records to show what a person did.
- Part 8Coming next
NTFS: the file system remembers
Read $MFT and $UsnJrnl, recover deleted file names and spot timestamps that were changed on purpose.
- Part 9Coming next
Memory forensics
List processes, network connections and command lines from a memory image, and find code that does not belong.
- Part 10Coming next
Following an attacker between machines
Trace RDP, SMB, PsExec, WMI and remote services across hosts, using JPCERT/CC’s research on what each tool leaves behind.
- Part 11Coming next
Building the timeline and writing the report
Combine sources into one timeline, map findings to ATT&CK, state confidence and write a report others can act on.
- Part 12Coming next
Capstone: a full case on your own
Investigate NIST’s Data Leakage Case from start to finish and check every answer against NIST’s published key.