All Learning Pathways
COURSE 04 · 10 WEEKS · 80 GUIDED HOURS

Digital Forensics & Incident Response (DFIR)

Evidence handling, endpoint and network analysis, timeline reconstruction and incident response

Duration: 10 weeks
Guided Learning: 80 guided hours
Level: Beginner to Intermediate
Suggested Capstone: 40% of Assessment
Explore Course (10 Weeks) Compare All 4 Courses
Programme Architecture

Course Overview & Target Audience

Grounded entirely in our official academic course specifications.

What You Will Learn

This course develops foundational skills for investigating cybersecurity incidents and examining digital evidence. Learners practice evidence integrity and documentation, disk and file-system analysis, Windows and Linux artifact review, memory forensics concepts, network forensics, incident response, and timeline reconstruction. Practical work uses controlled evidence sets and simulated scenarios.

Summary: Learn how to preserve digital evidence, analyse Windows/Linux artifacts and network traffic, reconstruct timelines, and investigate incidents through structured forensic workflows and reporting.

Who Should Attend & Prerequisites

Target Audience:

Undergraduate students, freshers, SOC analysts, IT professionals, and learners interested in digital investigations or incident response.

Prerequisites:

Basic computer literacy is required. Introductory networking and operating-system knowledge is recommended.

Practical Competencies

Documented Learning Outcomes

Verifiable capabilities developed through guided exercises, technical investigations, and structured reporting.

Explain the purpose, scope and phases of digital forensics and incident response.
Preserve and document potential digital evidence using appropriate handling procedures.
Explain chain of custody, hashing, integrity verification and forensic copies.
Perform basic Windows and Linux artifact analysis.
Examine prepared disk images, metadata, browser artifacts and logs.
Describe memory forensics concepts and conduct guided analysis of a provided image.
Analyse packet captures and correlate network observations with endpoint artifacts.
Reconstruct a timeline and distinguish confirmed facts from hypotheses.
Produce a structured forensic report and incident-response recommendations.
Week-by-Week Syllabus

Complete Course Breakdown

Each week is planned for approximately 8 guided hours, combining concept instruction, demonstration, guided practice, and review.

Week 1 Introduction to Digital Forensics and Incident Response
  • Digital forensics, incident response and how they fit together
  • Common incidents: malware, account compromise, data exposure and insider activity
  • Forensic investigation lifecycle and incident response roles
  • Evidence sources: endpoints, servers, cloud services, networks and applications
  • Legal, ethical, privacy and authorization considerations
  • Incident intake, scope definition and investigation planning
Hands-on Practice: Review a simulated incident, identify possible evidence sources and define an initial investigation plan and key questions.
Expected Deliverable: Incident intake form and evidence-source checklist.
Week 2 Evidence Handling, Acquisition and Integrity
  • Digital evidence characteristics and volatile versus non-volatile data
  • Order of volatility and acquisition considerations
  • Evidence preservation, documentation and chain of custody
  • Forensic imaging concepts and working from verified copies
  • Hashing and integrity verification
  • Write blockers, safe evidence handling and limitations
Hands-on Practice: Calculate SHA-256 hashes, verify provided evidence integrity and complete a chain-of-custody record for a training image.
Expected Deliverable: Evidence handling record and integrity verification worksheet.
Week 3 Disk Forensics and File-System Analysis
  • Storage, partitions, volumes and file-system fundamentals
  • File-system metadata, timestamps and deleted-file concepts
  • File signatures, extensions and metadata inconsistencies
  • Disk image formats and forensic acquisition concepts
  • File discovery, recovery considerations and artifact references
  • Limits of interpretation and reproducibility
Hands-on Practice: Examine a provided disk image, identify files of interest and review metadata; attempt selected recovery where supported by the training image.
Expected Deliverable: Disk examination notes with artifact references and limitations.
Week 4 Windows Forensics
  • Windows Event Logs and Event Viewer
  • Registry fundamentals and forensic relevance
  • Prefetch, LNK files, Jump Lists and Recent Files concepts
  • User activity, execution artifacts and external-device indicators
  • Windows Defender and Sysmon telemetry
  • Timestamp interpretation and correlation across artifacts
Hands-on Practice: Analyse a prepared Windows evidence set, identify suspicious logon or execution activity and correlate available artifacts.
Expected Deliverable: Windows artifact analysis report and preliminary user-activity timeline.
Week 5 Linux Forensics and Log Analysis
  • Linux file-system and system artifact overview
  • Authentication, system and service logs
  • Shell history and command-execution traces
  • Accounts, permissions, scheduled tasks and process evidence
  • SSH access and suspicious login investigation
  • Log integrity, gaps and limits of individual artifacts
Hands-on Practice: Investigate a simulated Linux server compromise using authentication logs, shell history and service activity.
Expected Deliverable: Linux investigation worksheet and preliminary timeline.
Week 6 Memory Forensics and Malware Investigation Fundamentals
  • Memory forensics concepts and use cases
  • Volatile evidence and acquisition considerations
  • Processes, modules, network connections and handles
  • Introduction to Volatility 3 or an equivalent memory-analysis workflow
  • Indicators of compromise and basic malware analysis concepts
  • Safe handling of suspicious files and limitations of static evidence
Hands-on Practice: Analyse a provided memory image with a guided workflow, identify suspicious process or connection context and review a benign sample or pre-generated analysis report.
Expected Deliverable: Memory analysis findings and an IOC list with supporting evidence.
Week 7 Network Forensics
  • Network evidence sources and PCAP fundamentals
  • TCP/IP and common protocol review
  • DNS, HTTP/S and connection analysis
  • Identifying suspicious communication patterns
  • Network indicators, time correlation and evidence limits
  • Correlating packet observations with endpoint artifacts
Hands-on Practice: Analyse a prepared packet capture in Wireshark, identify notable communications and correlate observations to a simulated endpoint timeline.
Expected Deliverable: Network forensic analysis report with timestamps and relevant indicators.
Week 8 Incident Response Operations and Threat Investigation
  • Incident identification, triage and prioritization
  • Scoping, impact assessment and evidence preservation
  • Containment, eradication, recovery and validation
  • Incident communications, ownership and escalation
  • IOC collection and threat-intelligence context
  • Root-cause analysis and post-incident lessons learned
Hands-on Practice: Run a tabletop exercise for a compromised workstation and choose appropriate scoping, evidence collection, containment and escalation actions.
Expected Deliverable: Incident response plan and action log.
Week 9 Timeline Reconstruction and Forensic Reporting
  • Event normalization and timeline construction
  • Correlating endpoint, network and authentication evidence
  • Separating facts, hypotheses and unresolved questions
  • Documenting methods, repeatability and artifact references
  • Executive summaries versus technical detail
  • Recommendations, report quality review and remediation tracking
Hands-on Practice: Reconstruct a multi-source event timeline, develop a defensible incident narrative and peer-review a sample report.
Expected Deliverable: Investigation timeline and draft forensic report.
Week 10 DFIR Capstone and Career Preparation
  • Investigation planning and evidence inventory
  • Analysing endpoint, network and identity evidence supplied in the case
  • Reconstructing a sequence of events and assessing scope
  • Preparing IOCs and documenting uncertainty
  • Containment and remediation recommendations
  • Presenting findings and building a sanitized portfolio artifact
Hands-on Practice: Investigate a simulated enterprise incident involving suspicious account activity and a compromised endpoint using prepared logs, artifacts and a packet capture.
Expected Deliverable: Final forensic report, chain-of-custody documentation, event timeline, artifact references, IOC list where applicable, impact assessment and response recommendations.
Tooling & Infrastructure

Tools, Software & Lab Environments

Transparent breakdown of course tools, target scenarios, and environment boundaries.

Course Tools & Software

Documented software and utilities utilized across weekly exercises:

Autopsy and The Sleuth KitWindows Event Viewer and Registry Explorer or equivalent viewersVolatility 3WiresharkSHA-256 utilities such as sha256sum or PowerShell hashingWindows Event Logs and SysmonLinux system and authentication logsVirtualBox / VMware / UTM lab setup

Target Environments

Prepared forensic disk images, memory captures (.dmp/.raw), Windows and Linux forensic artifact samples, and simulated enterprise incident cases.

All offensive testing and evidence parsing are strictly confined to authorized training systems.

Environment Boundaries

The academy utilizes open-source and free community tools. We do not provide commercial software licenses (such as Burp Suite Professional) or live enterprise systems.

Cloud security exercises run in learner-provisioned subscriptions or prepared telemetry datasets.

Evaluation Framework

Suggested Assessment Structure

Assessment components documented in the official course syllabus.

10%
Knowledge checks and quizzes

Part of the suggested assessment structure in the official syllabus.

30%
Guided practical labs

Part of the suggested assessment structure in the official syllabus.

20%
Investigation assignments and reports

Part of the suggested assessment structure in the official syllabus.

40%
Final DFIR capstone

Part of the suggested assessment structure in the official syllabus.

Proposed Passing Threshold (Awaiting Final Client Confirmation)

The course specifications suggest a 70% overall minimum score, including satisfactory completion and submission of the final capstone project. Note: This passing threshold is a proposal and requires final client confirmation before formal cohort enrolment begins.

Course Questions

Frequently Asked Questions

Grounded in documented course specifications and operational policies.

What tools will I use for forensic analysis?
The course utilizes Autopsy, The Sleuth Kit, Registry Explorer, Volatility 3, Wireshark, standard cryptographic hashing utilities (sha256sum / PowerShell), Windows Event Viewer, and Sysmon.
How are forensic evidence sets provided to learners?
Learners work with pre-packaged, legally clean forensic disk images, packet captures, and memory dumps representing simulated enterprise incident scenarios in isolated virtual environments.
Does this course teach live forensic response on corporate production systems?
No. All incident response workflows are conducted on simulated evidence captures and controlled training virtual machines. No live corporate enterprise networks are accessed.
What is the capstone requirement for this course?
Learners complete an in-depth forensic investigation of a multi-stage enterprise breach scenario, producing a comprehensive evidence-based report that accounts for 40% of the suggested assessment structure. The 70% passing threshold is proposed and awaiting final client confirmation.
Have questions about enrolment schedules or payment arrangements? Specific cohort dates and digital payment methods are currently unconfirmed.
Next Steps

Ready to Explore Further Pathways?

Compare our practice-led training courses across SOC Analysis, Ethical Hacking, Azure Cloud Security, and Digital Forensics, or review our hands-on laboratory environments.

View All 4 Courses Explore Practical Labs
Explore Other Tracks

Related Cybersecurity Pathways