Introduction to digital forensics and incident response
You learn what counts as evidence in a digital incident, how it is collected without being altered and verified with hashes, and what a DFIR analyst’s day looks like.
Level 101 · 17 lessons · 15 practice labs
Lessons
What forensics is
- What DFIR is: where forensics meets incident response
- Types of digital evidence: disk, memory, network, logs, accounts
- Every contact leaves a trace: Locard’s principle in the digital world
- The six questions of an investigation: who, what, when, where, how, why
- Short task: list the evidence sources in an incident story
Preserving evidence
- Hash values: a file’s fingerprint with sha256sum
- How the hash changes when one byte changes
- Mounting evidence read-only: mount -o ro and why it matters
- Chain of custody: who received what, and when
- Never touch the original: examining a working copy
- Short task: hash an evidence folder and log it
Law, ethics and the profession
- Admissibility of evidence: core rules across jurisdictions
- Authority, scope and personal data: what you may examine
- International guidance: ISO/IEC 27037 and the NIST approach
- DFIR roles: SOC, incident responder, examiner, malware analyst
- Keeping analyst notes: timestamped, repeatable records
- Capstone: take in a USB stick’s contents by the rules of evidence and report
Practice labs
- Pull the evidence sources from an incident story: Read a short incident story and list the disk, memory, network, log and cloud account evidence separately.
- Match the six questions to evidence: Write the evidence source that could answer each of who, what, when, where, how and why.
- Every contact leaves a trace: predict the traces: In a scenario where an employee copies files to a USB stick, predict at least eight traces and where they would be found.
- Take a file's fingerprint: Take the SHA-256 hash of three evidence files and write them to a hash list.
- What happens when one byte changes: Change one byte in a copy of a file, compare the two hashes and prove with the list which copy was altered.
- Hash and verify an evidence folder: Produce the hash list of a hundred-file folder and find two files changed afterwards by re-verifying.
- Mount an image read-only: Mount a disk image read-only and show that a write is refused.
- Examine with a working copy: Make a working copy of the original evidence, verify the hashes match and examine only the copy.
- Show the trace of a wrong mount: Mount the same image once writable and once read-only and prove in which case the hash changed.
- Fill in a chain of custody form: Record the handover of a USB stick on the form with who, when and what.
- Keep timestamped analyst notes: Document a ten-step examination with timestamped notes someone else could repeat.
- Take in a USB stick by the rules: Hash the prepared USB image, examine it read-only, list its contents and write the intake report.
- Match DFIR roles to tasks: Match SOC analyst, incident responder, forensic examiner and malware analyst to eight tasks.
- What you may look at: draw the scope: Split the data that may and may not be examined into two columns according to a given authorisation letter.
- Audit a process against the guidance: Audit a fictional intake process against the ISO/IEC 27037 and NIST approach and write five gaps.
About this course
You learn what counts as evidence in a digital incident, how it is collected without being altered and verified with hashes, and what a DFIR analyst’s day looks like.
What you will learn
- What forensics is
- Preserving evidence
- Law, ethics and the profession
Prerequisites
No prior knowledge is needed; the course starts from zero.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at beginner level; every term is explained where it first appears.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.