Digital Forensics & Incident Response
Digital Forensics & Incident Response
Evidence-first IR skills.
Evidence collection/preservation, disk/memory/network forensics, log analysis, malware investigation, IR lifecycle and documentation.
- Level
- Intermediate
- Duration
- 10 weeks
- Modules
- 1 modules · 12 lessons
- Learning method
- Lessons + labs
What you will learn
- Preserve evidence integrity
- Build a basic timeline from lab artifacts
- Document an IR case clearly
Course curriculum
Expand each module for lessons, progress, and labs assigned to that module — not a flat topic dump.
Module 1
Forensics & IR
Full DFIR topic set for Wave 1 notes.
0/12 lessons
Module 1
Forensics & IR
Full DFIR topic set for Wave 1 notes.
0/12 lessons
Lessons
- 1. Digital Forensics Fundamentalspreview~20 min
- 2. Evidence Collection~20 min
- 3. Evidence Preservation~20 min
- 4. Disk Forensics~20 min
- 5. Memory Forensics~20 min
- 6. Windows Event Analysis~20 min
- 7. Linux Log Analysis~20 min
- 8. Network Forensics~20 min
- 9. Malware Investigation~20 min
- 10. Incident Response Lifecycle~20 min
- 11. Threat Investigation~20 min
- 12. Incident Documentation~20 min
Module labs
- IR Timeline Order
- IR Phase Pick
- Windows Event Pick
- Find the Noisy IP
- YARA Rule Match
- YARA Purpose
- Map the Technique
- Post-Compromise Persistence Investigation
- Recovery & Hardening After Persistence
- Event Viewer & Auth Log Hunt
- Linux Forensics Fundamentals
- Log & Auth Forensics
- Filesystem Timeline Analysis
- DFIR Reporting & Evidence Narrative
Enrol to unlock full lessons and track module progress.
OSINT in this course
Open-source intelligence is taught here — not only under Resources. Use authorized, public sources; no doxing or harassment; document sources and timestamps.
- Image and media verification — Provenance, reverse search, and deepfake triage.
Inside this course
Labs · Quizzes · Certificate
Labs below are curated for this syllabus (shared engine, course-specific assignments). They unlock with enrol; quizzes match course topics; finish ≈90%+ to claim a CYNARKS Academy certificate.
Course labs
14 assigned labs · free with this course enrol
- IR Timeline OrderUnlock via course or plan
- IR Phase PickUnlock via course or plan
- Windows Event PickUnlock via course or plan
- Find the Noisy IPUnlock via course or plan
- YARA Rule MatchUnlock via course or plan
- YARA PurposeUnlock via course or plan
- Map the TechniqueUnlock via course or plan
- Post-Compromise Persistence InvestigationUnlock via course or plan
+6 more assigned
Track quiz
204 questions matched to this course topics
Knowledge checks for this track only — not a separate global quiz menu.
Start track quizCYNARKS certificate
Educational completion certificate · verify by ID
Your progress: 0% · enrol to unlock claim
Enrol in this course first.