Ethical Hacking & Penetration Testing
Linux DFIR
Hash, image, timeline, hunt logs/network, contain malware, and report — lab evidence only.
Eight practical Linux DFIR labs on synthetic evidence: chain of custody and hashing, read-only disk/filesystem analysis, memory volatility concepts, auth.log SSH hunts, MACB-style timelines, beacon detection in conn/PCAP summaries, malware IR containment without destroying evidence, and stakeholder-ready reporting with IOC and custody appendices. Authorized training images only — no unauthorized forensics on live orgs.
- Level
- Advanced
- Duration
- 4–6 weeks
- Modules
- 4 modules · 8 lessons
- Learning method
- Lessons + labs
What you will learn
- Hash originals and maintain chain-of-custody logs on lab images
- Mount and analyze working copies read-only with noexec discipline
- Explain why memory is captured before disk when policy allows
- Hunt brute-then-success SSH patterns in synthetic auth logs
- Build investigation windows from auth + filesystem + network events
- Identify beacon-like destinations in conn/PCAP summaries
- Contain malware findings with isolate → preserve → sandbox → rebuild
- Write DFIR reports with executive summary through custody appendix
Course curriculum
Expand each module for lessons, progress, and labs assigned to that module — not a flat topic dump.
Module 1
Evidence handling and disk forensics
Custody, hashing, and safe read-only filesystem analysis on working copies.
0/2 lessons
Module 1
Evidence handling and disk forensics
Custody, hashing, and safe read-only filesystem analysis on working copies.
0/2 lessons
Lessons
- 1. Linux Forensics Fundamentalspreview~20 min
- 2. Disk and Filesystem Forensics~20 min
Enrol to unlock full lessons and track module progress.
Module 2
Memory concepts and auth log hunts
Volatile capture rationale and SSH/sudo evidence in auth logs.
0/2 lessons
Module 2
Memory concepts and auth log hunts
Volatile capture rationale and SSH/sudo evidence in auth logs.
0/2 lessons
Lessons
- 1. Memory Forensics Concepts~20 min
- 2. Log and Auth Forensics~20 min
Enrol to unlock full lessons and track module progress.
Module 3
Timelines and network forensics
Correlate host times with beacon-like network summaries.
0/2 lessons
Module 3
Timelines and network forensics
Correlate host times with beacon-like network summaries.
0/2 lessons
Lessons
- 1. Filesystem Timeline Analysis~20 min
- 2. Network Forensics on Linux~20 min
Enrol to unlock full lessons and track module progress.
Module 4
Malware IR and reporting
Evidence-safe containment and stakeholder DFIR write-ups.
0/2 lessons
Module 4
Malware IR and reporting
Evidence-safe containment and stakeholder DFIR write-ups.
0/2 lessons
Lessons
- 1. Malware and Compromise Incident Response~20 min
- 2. DFIR Reporting and Evidence Narrative~20 min
Enrol to unlock full lessons and track module progress.
Inside this course
Labs · Quizzes · Certificate
Labs below are curated for this syllabus (shared engine, course-specific assignments). They unlock with enrol; quizzes match course topics; finish ≈90%+ to claim a CYNARKS Academy certificate.
Course labs
8 assigned labs · free with this course enrol
- Linux Forensics FundamentalsUnlock via course or plan
- Disk & Filesystem ForensicsUnlock via course or plan
- Memory Forensics ConceptsUnlock via course or plan
- Log & Auth ForensicsUnlock via course or plan
- Filesystem Timeline AnalysisUnlock via course or plan
- Network Forensics on LinuxUnlock via course or plan
- Malware & Compromise Incident ResponseUnlock via course or plan
- DFIR Reporting & Evidence NarrativeUnlock via course or plan
Track quiz
99 questions matched to this course topics
Knowledge checks for this track only — not a separate global quiz menu.
Start track quizCYNARKS certificate
Educational completion certificate · verify by ID
Your progress: 0% · enrol to unlock claim
Enrol in this course first.