Forensics, incident response and malware

32 courses, 489 lessons. A real Kali Linux lab in the browser.

Introduction to digital forensics and incident response (Level 101, 17 lessons): You learn what counts as evidence in a digital incident, how it is collected without being altered and verified with hashes, and what a DFIR analyst’s day looks like.
Files and metadata: what a file tells you (Level 101, 14 lessons): You identify files by content rather than extension, read author and time from metadata, and spot data hidden inside files with simple tools.
Forensics practice: first puzzles (Level 101, 12 lessons): Short unguided puzzles reinforce file identification, hashing, metadata and log reading; for each flag you note how you found it.
Digital forensics fundamentals: dd, Foremost, ExifTool (Level 201, 17 lessons): Evidence handling, timelines and disk examination.
Evidence acquisition: disk, live system and remote collection (Level 201, 15 lessons): You take disk images in raw and E01 formats, collect volatile data from a live system in the right order, and pull evidence safely from a remote server over the network.
File system forensics: FAT, NTFS and ext4 (Level 201, 17 lessons): You read partition tables, learn how FAT, NTFS and ext4 store and delete data, and find deleted files and leftovers in slack space.
Linux forensic artefacts: logs, history and persistence (Level 201, 16 lessons): On a compromised Linux server you examine login records, shell history, scheduled jobs, services and SSH keys to reveal what the attacker did.
Windows forensic artefacts: what the user did (Level 201, 18 lessons): From Prefetch, LNK files, jump lists, shellbags, Amcache and USB history you work out which program a Windows user ran and when, which files they opened and which devices they plugged in.
Log analysis: from syslog to web server logs (Level 201, 18 lessons): You filter system, authentication and web server logs with grep, awk and jq, merge different sources onto one clock, and follow an attack with simple SIEM queries.
Browser and email forensics (Level 201, 15 lessons): You read browser history, downloads and cookies from SQLite databases, and use email headers to reveal a phishing message’s real source and whether the user clicked.
Memory forensics: avml and Volatility (Level 301, 16 lessons): Taking a memory dump and examining it with Volatility.
Malware analysis fundamentals: strings, strace, ltrace (Level 301, 18 lessons): Static and behavioural analysis.
Incident response: from preparation to lessons learned (Level 301, 20 lessons): Following NIST SP 800-61, you detect, contain, eradicate and recover from incidents, managing chain of custody, communication and lessons learned.
Timeline analysis: from mactime to the super timeline (Level 301, 16 lessons): You merge file system times with mactime and hundreds of artefact sources with plaso into one timeline, then filter millions of rows down to the minutes that matter.
Windows registry forensics (Level 301, 16 lessons): You extract registry hives from an image and use RegRipper and registry viewers to examine user activity, installed software, network history and persistence keys.
Tracing attacks with Windows event logs (Level 301, 19 lessons): You read logons, process starts and lateral movement in Security, System, PowerShell and Sysmon logs, and sweep EVTX files against Sigma rules with Chainsaw and Hayabusa.
Disk examination with The Sleuth Kit and Autopsy (Level 301, 16 lessons): You examine an image layer by layer with The Sleuth Kit commands, then open the same case in Autopsy and turn it into reportable findings with keyword search, hash sets and tags.
Windows memory analysis with Volatility 3 (Level 301, 18 lessons): You examine processes, command lines, loaded DLLs, handles, network connections and the in-memory registry in Windows dumps with Volatility 3, and single out the suspicious process with evidence.
Document and script triage: macros, PDFs, PowerShell (Level 301, 17 lessons): You examine suspicious Office files with oletools and PDFs with pdfid and pdf-parser without opening them, and decode obfuscated JavaScript, VBScript and PowerShell in a safe lab to extract indicators.
Response playbooks and tabletop exercises (Level 301, 15 lessons): You write step-by-step playbooks for phishing, ransomware and account takeover, test them in tabletop exercises and track team readiness with measurable metrics.
Forensics practice arena (Level 301, 15 lessons): In unguided tasks mixing disk, memory, log and document evidence you test your speed and accuracy, documenting each solution in a short findings note.
Advanced memory analysis: injection, hiding and Linux memory (Level 401, 14 lessons): You catch code injection, process hollowing and hidden processes in memory, go deeper into Linux dumps with Volatility and sweep memory with YARA rules.
Dynamic triage in an isolated sandbox (Level 401, 14 lessons): You build an analysis environment cut off from the internet, observe a suspicious sample against fake network services, record its process, file and network activity and turn it into indicators defenders can use.
Responding to a ransomware incident (Level 401, 13 lessons): As soon as encryption starts you stop the spread, establish the initial access and whether data was taken, restore safely from backups and present decision options to management.
Live response across a fleet: Velociraptor and osquery (Level 401, 13 lessons): You ask hundreds of endpoints the same question at once, collect targeted evidence with Velociraptor, query system state with osquery and bring the findings together centrally.
Endpoint threat hunting: Sysmon and auditd (Level 401, 15 lessons): Starting from a hypothesis, you search Sysmon data on Windows and auditd data on Linux for attacker traces that have not yet raised an alert, and turn your findings into lasting detection rules.
Case file: patient data access at Orchard Clinic (Level 401, 13 lessons): At the fictional Orchard Clinic you follow the evidence from an oddity on a reception PC to the server where patient data was accessed, and determine the scope and the duty to notify.
Case file: an inside job at Tidewater Savings (Level 401, 12 lessons): At the fictional Tidewater Savings you establish the employee and the method behind suspicious transfers using workstation, email, application logs and physical access data, in a way that respects the law and personal rights.
Detecting anti-forensics (Level 501, 12 lessons): You catch timestomped files, deleted or tampered logs, secure wiping and hidden data, and prove what happened even on a system that appears to have no traces.
Hunting rootkits in memory (Level 501, 12 lessons): You catch code hiding at kernel level through inconsistencies in the SSDT, IDT, callbacks and module lists, and detect Linux loadable-kernel-module rootkits from a memory dump.
Leading a major incident: incident command (Level 501, 13 lessons): In a major incident with many teams working at once you take command, keep a decision log, handle communication with legal, regulators, customers and the press, and close the incident without burning out the team.
DFIR analyst capstone project (Level 501, 13 lessons): As a DFIR analyst you start from a single alert and run the case end to end yourself: acquisition, disk, memory, log and network analysis, containment advice and a court-ready report.

Projects

Verify a received USB image and start the chain of custody: You verify the hash values of a USB stick image handed to Sedirli Hukuk Bürosu, make a working copy, and fill in the chain-of-custody form completely.
Narrow down the source from leaked photos’ metadata: You read the metadata of a set of photos and documents shared without permission at Gelincik Okulları with ExifTool and explain in a findings note which device made them and when.
Recover deleted design files from a USB image: You examine the file system in the image of a USB stick returned by an employee leaving Karaçam Mobilya, recover deleted design files, and report what was deleted and when.
Trace an intrusion on a Linux server: In a prepared evidence package from Kuzeyyıldızı Kargo’s tracking server you examine login records, shell history, scheduled jobs and SSH keys, and write a summary telling what happened in order.
Reveal what the user did on a Windows laptop: In the prepared image of a laptop under review at Yelkovan Bankası you find recently opened files, executed programs and connected USB devices, and lay out the user’s activity that day in a report.
Trace a phishing click through mailbox and browser: You examine a Lavinya Klinikleri employee’s mailbox export and browser history database and show the chain from the phishing message to the downloaded file with timestamps.
Collect evidence from a running server in the right order: From Ayçiçeği Gıda’s oddly behaving order server you collect memory, process, network and disk evidence in order of volatility, hash each piece, and hand it over with a collection log.
Incident response and malware triage: You run incident response on a suspicious system, do a first look at a malware sample in an isolated environment, and collect the findings in an incident report.
Remove a process that keeps coming back: You trace a suspicious process that keeps coming back to its source, remove it for good, and show it does not return even after a restart.
Recover a service from a tampered backup: You check a backup suspected of being tampered with, restore the service from a trusted copy, and prove the system runs cleanly.
Find the suspicious process in a memory dump (Volatility 3): In a prepared memory dump from an accounting computer at Mavikaya Lojistik you examine the process tree, command lines and network connections with Volatility 3 and report the suspicious process with evidence.
Unravel a remote desktop intrusion with event logs and registry: In prepared evidence from a Saklıvadi Üniversitesi server you join logon events, new service records and registry traces into one timeline from first entry to last activity.
Triage a suspicious invoice document without running it: From an inert training sample of a suspicious invoice document sent to Ayçiçeği Gıda’s accounting team you extract the macro without running it, explain what it tries to do, and prepare an indicator list for blocking.
Scope a ransomware incident and set the recovery order: From prepared evidence of a ransomware incident at Ilgıntepe Tekstil you identify the entry point and affected systems, verify the backups are clean, and recommend a recovery order to management.
Sweep every endpoint for an incident’s indicators: You search five machines at once with Velociraptor and osquery for indicators found on one Yakamoz Telekom server, single out the affected ones, and present the evidence collected from each in a sweep report.
Observe an inert sample in isolation and write a behaviour report: For Göktaşı Yazılım’s incident team you run an inert training sample in a sandbox with no outside network, record its file, process and network behaviour, and report indicators and detection suggestions for the defence team.
Expose attempts to erase traces: timestamps and logs: In a prepared image from a Lodoskaya Denizcilik server you find inconsistent timestamps, log gaps and traces of deleted records, and report with reasons which parts of the evidence can be trusted.
Lead a major incident: decision log and status reports: In a prepared scenario unfolding hour by hour at Demirsu Enerji you act as incident commander, assign roles, keep a decision log, and write status reports for management and the regulator.