Digital Forensics & Incident Response — Study Course

The official preparation course for the Digital Forensics & Incident Response certification: structured modules, worked examples and exam-focused practice.

Key facts

• Course price: $195 (one-time payment)
• Field: Cybersecurity & Information Security
• Prepares for: Digital Forensics & Incident Response
• 7 modules · 23 lessons · about 6 hours of lessons
• Self-paced, online, illustrated lessons

Course outline

1. Foundations of Digital Forensics & Incident Response — Establish the core principles, terminology, and legal framework that underpin every DFIR investigation.
   • The DFIR Discipline: Scope, Goals and Career Landscape
   • Legal & Ethical Framework: Evidence, Admissibility and Privacy
   • Chain of Custody and Evidence Handling
   • The Incident Response Lifecycle
2. Evidence Acquisition and Forensic Imaging — Master the techniques for acquiring volatile and non-volatile evidence from endpoints, servers, and cloud environments without contaminating the source.
   • Volatile Evidence and Memory Acquisition
   • Disk Imaging: Techniques, Tools and Formats
   • Cloud and Container Forensics
   • Triage and Live Response with EDR and Velociraptor
3. Disk and File System Forensics — Analyze file systems, recover deleted data, understand timestamps and artifact locations on Windows and Linux systems.
   • Windows File System Forensics: NTFS Deep Dive
   • Windows Registry Forensics
   • File Carving, Deleted File Recovery and Artifact Parsing
4. Memory Forensics and Malware Analysis — Analyze RAM captures to find injected code, attacker tools, and malware behavior without executing a single malicious file.
   • Memory Forensics with Volatility
   • Lateral Movement and Persistence Detection
   • Malware Triage and Behavioral Analysis
5. Log Analysis and Network Forensics — Reconstruct attacker activity through systematic analysis of system logs, firewall data, and captured network traffic.
   • Windows and Linux Log Analysis
   • Network Forensics and PCAP Analysis
   • SIEM, Threat Hunting and IOC Development
6. Incident Response Operations — Execute containment, eradication, and recovery with professional discipline while managing communication and documentation.
   • Containment Strategies and Decision Frameworks
   • Eradication, Recovery and Post-Incident Hardening
   • Incident Reporting and Post-Incident Review
7. Exam Readiness: DFIR Certification Preparation — Consolidate core DFIR concepts, understand exam structure, practice with scenario-based questions, and develop a proven study strategy.
   • Core Concepts Recap: The DFIR Knowledge Map
   • Exam Landscape: GCFE, GCFA, GCIH and Related Certifications
   • Scenario-Based Practice and Exam Strategy