Mastering Digital Forensics and Incident Response: The Ultimate Guide to Becoming a GIAC Certified Forensic Analyst
You’re under pressure. Systems are compromised. Executives want answers now. And you’re expected to lead the charge, even if you’re not sure where to begin-or how to prove your findings hold up under scrutiny. Every second counts during an incident. You need more than theory. You need a repeatable, court-admissible, battle-tested methodology that delivers clarity when it matters most. The difference between being seen as a technical operator and a strategic security leader comes down to one thing: precision under pressure. Mastering Digital Forensics and Incident Response: The Ultimate Guide to Becoming a GIAC Certified Forensic Analyst is not another generic checklist. It’s a complete, step-by-step transformation system that turns uncertainty into authority. This is how you go from reactive responder to a trusted analyst who can reconstruct attacks, defend findings, and secure recognition across legal, executive, and technical teams. The outcome? Within 60 days, you’ll have a complete, professional-grade forensic investigation framework, documented with courtroom-level integrity. You’ll be fully prepared to earn your GIAC certification, with a portfolio of real-world analysis templates, chain-of-custody workflows, and incident response playbooks that demonstrate mastery. Like Sarah M., a cybersecurity analyst in Seattle, who used this exact structure to lead her first major breach investigation. “I walked in unsure if I could even identify the initial entry point. By week six, I was presenting forensic timelines to the CISO-complete with artifact validation and timeline correlation. I passed the GCFE exam on my first try, and within two months, I was promoted.” This course is different because it mirrors how elite forensic investigators think, document, and defend their work-not how textbooks describe it. Here’s how this course is structured to help you get there.Course Format & Delivery Details Self-paced. Immediate online access. No deadlines. No pressure. Just progress-on your terms. This course is designed for the working professional who needs depth without disruption. You gain on-demand access to all materials the moment you enroll, with no fixed start dates or time commitments. Most learners complete the core modules in 8–10 weeks while working full time, with many reporting their first usable investigation report within 14 days. Lifetime Access & Future-Proof Learning
You're not buying a temporary subscription. You're investing in a permanent reference system. You receive lifetime access to all course content, including future updates at no additional cost. As forensic tools evolve and attack techniques shift, your materials evolve with them-ensuring your knowledge stays current and relevant for years. Accessible Anywhere, Anytime
With 24/7 global access and mobile-friendly compatibility, you can study during your commute, review a procedure mid-incident, or refresh critical steps during an investigation-all from your phone, tablet, or laptop. The system is built for real-world usability, not just academic completion. Direct Instructor Support & Guidance
You are not alone. This course includes access to expert-led guidance through structured feedback pathways. Every investigation technique is accompanied by real-world application directives, with direct support available for clarification on forensic logic, tool integration, and certification preparation. Certificate of Completion: Your Proof of Mastery
Upon finishing the course, you earn a verifiable Certificate of Completion issued by The Art of Service-a globally recognised credential trusted by security teams in regulated industries worldwide. This certificate demonstrates not just course completion, but applied competence in forensic workflows aligned with GIAC GCFE standards. Transparent, One-Time Pricing. No Hidden Fees.
The price you see is the price you pay-no recurring charges, no upsells, no surprise costs. We accept Visa, Mastercard, and PayPal, ensuring a seamless enrollment process for professionals worldwide. Zero-Risk Enrollment: Satisfied or Refunded
We eliminate your risk with a full money-back guarantee. If you complete the first two modules and don’t believe this course will accelerate your forensic expertise and certification readiness, simply request a refund. No questions asked. You have nothing to lose-and a career-defining skill set to gain. Immediate Confirmation. Seamless Access.
After enrollment, you’ll receive an instant confirmation email. Your access credentials and course portal details will be sent separately once your materials are fully configured-ensuring a secure and reliable learning environment from day one. Will This Work for Me?
Yes-if you’re committed to advancing your role in cybersecurity. This program works even if: - You’ve never led a full forensic investigation
- You’re transitioning from general IT or SOC operations
- You’re unfamiliar with forensic tooling like FTK, Autopsy, or X-Ways
- You’re unsure how digital evidence holds up in legal contexts
- You’ve failed a certification attempt before
This course works because it doesn’t assume prior expertise. It builds forensic confidence from the ground up-using structured workflows, repeatable checklists, and proven documentation standards used by top-tier DFIR teams. It’s not about memorisation. It’s about doing. And when you finish, you won’t just “know” digital forensics-you’ll apply it with authority.
Module 1: Foundations of Digital Forensics and the Incident Response Lifecycle - Introduction to digital forensics: definitions, scope, and real-world impact
- Understanding the role of a forensic analyst in modern security teams
- Key legal and ethical considerations in digital investigations
- Chain of custody principles and documentation requirements
- Differentiating between incident response and digital forensics
- The NIST Incident Response Framework: phases and integration
- Incident classification: malware, insider threat, data exfiltration, ransomware
- Defining the investigative hypothesis: from alert to inquiry
- Understanding data volatility and evidence prioritisation
- Establishing a forensic workstation: hardware and software prerequisites
- Creating a secure, write-protected investigation environment
- Introduction to forensic soundness and admissibility standards
- Overview of common forensic challenges in enterprise environments
- Aligning forensic practices with regulatory requirements (GDPR, HIPAA, PCI DSS)
- Building a personal forensic toolkit: open-source and commercial options
Module 2: Legal and Regulatory Frameworks for Forensic Investigations - Federal rules of evidence and digital data admissibility
- Understanding the Daubert standard and its impact on forensic testimony
- Data privacy laws and their effect on forensic collection
- Cross-border data transfer and jurisdictional challenges
- Working with legal counsel during investigations
- Documentation standards for court-defensible reports
- When and how to issue legal holds
- The role of consent and authorisation in evidence acquisition
- Employee monitoring policies and forensic boundaries
- Reporting obligations under breach notification laws
- Handling personally identifiable information (PII) during analysis
- Audit trail requirements for digital evidence
- Forensic independence and avoiding conflicts of interest
- Using the FRE 901 standard for authentication of digital evidence
- Preparing for expert witness testimony
Module 3: Forensic Acquisition and Evidence Handling - Types of digital evidence: volatile, semi-volatile, non-volatile
- Live vs. dead acquisition: when to use each
- Best practices for acquiring RAM images using tools like DumpIt
- Disk imaging: bit-stream vs. logical captures
- Using dd, DCFLdd, and Guymager for reliable imaging
- Verifying integrity with MD5 and SHA-256 hash values
- Handling encrypted drives: full disk encryption strategies
- Imaging virtual machines and cloud instances
- Dealing with SSDs and TRIM: forensic challenges and mitigation
- Working with write blockers: hardware vs. software
- Creating portable forensic kits for field deployment
- Network-based acquisition and remote imaging
- Metadata preservation during collection
- Labelling and storing forensic images securely
- Documenting acquisition procedures for audit trails
- Automating acquisition workflows with scripting
Module 4: File System Fundamentals and NTFS Deep Dive - Overview of common file systems: FAT32, exFAT, NTFS, ext4, APFS
- Structure of NTFS: MFT, $Logfile, $Bitmap, $Boot
- Master File Table (MFT) analysis: parsing and interpretation
- Understanding file attributes: standard, extended, and resident
- File timestamps in NTFS: MACE times and their forensic significance
- Time zone handling and daylight saving time adjustments
- Timestomping detection and timeline reconstruction
- File fragmentation and its impact on recovery
- Alternate Data Streams (ADS) and their abuse in malware
- Recovering deleted files from MFT entries
- Volume Shadow Copy analysis and snapshot exploitation
- Disk slack and RAM slack: locating hidden data
- Unallocated space and file carving techniques
- NTFS permissions and access control lists (ACLs)
- Reconstructing file operations from journal entries
Module 5: Windows Registry Forensics - Overview of the Windows Registry structure: hives and keys
- Registry hives: SOFTWARE, SYSTEM, SAM, SECURITY, NTUSER.DAT
- Extracting and loading registry hives for analysis
- RecentAppCache and UserAssist: tracking user execution
- TypedPaths and OpenSaveMRU: user file interaction history
- USB device tracking: LastMountedVolume and USBStor keys
- Network connection history: NetworkList and Connections keys
- User profile creation and logon events in the Registry
- Persistence mechanisms: Run keys, services, and startup folders
- Program execution via Scheduled Tasks registry entries
- Jump lists and Automatic Destinations analysis
- SSP and Security Providers: detecting credential access
- AppCompatCache and ShimCache: detecting executed binaries
- AmCache.hve: forensic insights from program execution
- Timezone and system configuration data in SYSTEM hive
Module 6: Windows Event Log Analysis - Introduction to Windows Event Logs: XML structure and format
- Common log sources: Security, System, Application, PowerShell
- Event ID 4624: successful logons and session analysis
- Event ID 4625: failed logon attempts and brute force detection
- Event ID 4670: access permission changes and privilege escalation
- Event ID 4688: process creation and command-line logging
- Event ID 4697: service installation events
- Event ID 4720: account creation events
- Event ID 4738: account changes and lockout bypass
- Event ID 4740: account lockouts and their significance
- Event ID 4768–4771: Kerberos authentication flows
- PowerShell logging: Script Block, Module, and Transcription Logs
- Event log parsing with LogParser and PowerShell
- Timeline correlation across multiple event logs
- Detecting event log clearing and cover-up attempts
- Recovering deleted event logs from unallocated space
- Forwarded events and centralised logging forensic challenges
- Abuse of background tasks and WMI subscription events
Module 7: Memory Forensics with Volatility Framework - Introduction to memory forensics and its investigative value
- Understanding process address space and kernel memory
- Acquiring memory dumps from compromised systems
- Volatility 3 installation and configuration
- Identifying the correct profile for memory analysis
- Listing running processes and hidden malware
- Dumping malicious processes for external analysis
- Network connections and sockets: netstat equivalent
- Extracting command-line arguments from process memory
- Detecting process injection: hollowing, DLL injection
- Identifying rogue services and drivers
- Registry hives extraction from memory
- Recovering clipboard contents and user data
- Browser history and credential recovery from RAM
- Timeline reconstruction from memory artifacts
- Kernel callback inspection for rootkit detection
- Memory signature analysis for malware families
Module 8: Browser Forensics and Web Artifact Analysis - Overview of browser storage: cache, cookies, history, localStorage
- Chrome and Chromium-based browser forensics
- Reconstructing user browsing activity from History database
- Download tracking via Downloads database
- Recovering visited sites from Top Sites and Thumbnails
- Form data and autofill recovery from Web Data database
- Cookies analysis: session tracking and authentication tokens
- Extension analysis and malicious add-on detection
- IndexedDB and localStorage examination
- Firefox forensics: places.sqlite and cookies.sqlite
- Internet Explorer and Edge legacy artifact locations
- Incognito mode: myths and forensic reality
- Web-based email and cloud service identification
- Detecting data exfiltration via online forms
- Search engine query reconstruction
- Flash cookies and browser fingerprinting traces
- Extracting URLs from memory and prefetch
Module 9: Email and Communication Forensics - Forensic analysis of email clients: Outlook, Thunderbird
- Parsing PST and OST files for evidence
- Recovering deleted emails from PSTs
- SMTP headers analysis: tracking message origin
- Phishing email detection through header inspection
- Extracting attachments from email databases
- Metadata analysis in email content
- Chat forensics: Teams, Slack, WhatsApp, Signal
- Skype and VoIP call logging and recovery
- Social media account activity tracking
- Forensic implications of cloud-based messaging
- Recovering deleted messages from SQLite databases
- Timestamp alignment across communication platforms
- Detecting insider threat through messaging patterns
- Encryption and its impact on access to communications
Module 10: Malware Analysis and Reverse Engineering Fundamentals - Static vs. dynamic malware analysis: when to use each
- Safe execution environment setup: sandboxing principles
- Hashing and identifying known malware with VirusTotal
- Strings extraction and obfuscation detection
- File header analysis: PE structure and entropy
- Import Table analysis: identifying malicious API calls
- Packing detection and unpacking strategies
- Behavioral analysis: file, registry, process, network changes
- Dynamic analysis with Cuckoo and ANY.RUN
- Detecting persistence mechanisms in binaries
- Anti-analysis techniques: VM detection, debugger evasion
- Extracting C2 domains and IP addresses
- Logging network traffic with Wireshark and tcpdump
- API hooking and system call monitoring
- YARA rule creation for malware detection
- Producing actionable malware reports for IR teams
Module 11: Network Forensics and Packet Analysis - Introduction to network forensics and full packet capture
- TCP/IP fundamentals for forensic analysts
- Wireshark interface and display filtering
- Analyzing attack traffic: SYN floods, port scans, brute force
- Reconstructing HTTP sessions and file downloads
- Extracting images, documents, and credentials from captures
- DNS tunneling detection and investigation
- Identifying beaconing behavior in network streams
- SSL/TLS decryption with session keys from memory
- NetFlow and IPFIX analysis for large-scale monitoring
- Geolocating C2 servers from packet captures
- Detecting lateral movement through SMB and RDP
- VoIP call reconstruction from RTP streams
- Identifying encrypted channels and covert protocols
- Timeline correlation: aligning netflow with host events
- Using Zeek (formerly Bro) for automated log generation
Module 12: Timeline Analysis and Correlation - Building comprehensive timelines: super-timelines
- Timeline sources: file system, registry, logs, memory
- Creating timelines with Plaso and log2timeline
- Setting up evidence collection for timeline building
- Filtering and parsing timeline data effectively
- Using timezones and leap seconds correctly
- Identifying time gaps and anomalies in activity
- Correlating events across multiple hosts
- Detecting timestomping through anomaly detection
- Exporting timelines for reporting and visualisation
- Integrating timeline data with SIEM outputs
- Linking user activity to system events
- Highlighting critical windows of compromise
- Using timelines in court presentations
- Automating timeline updates during ongoing investigations
Module 13: Forensic Tools Mastery: FTK, Autopsy, and X-Ways - FTK Imager: disk imaging and previewing evidence
- Creating and managing cases in FTK
- Indexing and keyword searching at scale
- Hash filtering: identifying known good and bad files
- Email parsing and thread reconstruction in FTK
- Generating comprehensive reports from FTK
- Autopsy interface and case management
- Keyword and regular expression searches in Autopsy
- Using Kali Linux with Autopsy for advanced analysis
- File carving with Autopsy and Scalpel
- X-Ways Forensics: navigating the interface
- Template-based analysis and automation in X-Ways
- Volume cloning and comparison techniques
- Advanced search and data carving with X-Ways
- Registry and file system analysis in X-Ways
- Cross-verification of findings across multiple tools
- Optimising tool performance for large datasets
Module 14: Mobile Device Forensics - Physical, logical, and file system extraction methods
- iOS backup analysis: iTunes and iCloud
- Extracting data from iOS system files and databases
- Location data analysis: GPS, Wi-Fi, cell towers
- Call and message history recovery from SQLite
- Android ADB extraction and root access methods
- Analysing app data: WhatsApp, Telegram, Signal
- Browsing history and search activity on mobile
- Cloud sync forensics: Google Drive, iCloud, Dropbox
- Mobile malware indicators and detection
- Lock screen bypass and encryption considerations
- Bluetooth and pairing history analysis
- Using Magnet AXIOM and Cellebrite (conceptual workflow)
- Reporting on mobile evidence in investigations
- Legal considerations in mobile seizures
Module 15: Cloud and Virtual Environment Forensics - Challenges of cloud forensics: data ownership and access
- Understanding shared responsibility models (AWS, Azure, GCP)
- Acquiring evidence from S3 buckets and blob storage
- CloudTrail, Azure Monitor, and Cloud Audit Logs analysis
- Identifying suspicious API calls and privilege escalation
- Virtual machine memory and disk acquisition
- Snapshot forensics in virtual environments
- Detecting VM escape and hypervisor compromise
- Container forensics: Docker and Kubernetes artifact recovery
- Serverless function logs and execution traces
- Logging and monitoring in hybrid cloud environments
- Incident response playbooks for cloud-native attacks
- Using native cloud tools for evidence collection
- Timeline alignment across distributed services
- Preserving chain of custody in cloud investigations
Module 16: Incident Response Playbook Development - Designing incident response playbooks for common scenarios
- Structure of a playbook: objectives, steps, tools, escalation
- Playbook for ransomware: detection, containment, recovery
- Insider threat playbook: data access, exfiltration, detection
- Phishing and credential compromise response workflow
- Malware outbreak: containment and eradication steps
- Privilege escalation and lateral movement playbook
- Cloud account compromise: MFA bypass, API misuse
- Incident declaration criteria and severity classification
- Roles and responsibilities during an incident
- Communication templates: internal, legal, public
- Integration with SOAR platforms and ticketing systems
- Testing playbooks through tabletop exercises
- Version control and update procedures for playbooks
- Organising playbooks by MITRE ATT&CK technique
Module 17: Reporting and Presenting Forensic Findings - Structure of a forensic report: executive summary, methodology, findings
- Writing for technical and non-technical audiences
- Visualising timelines and attack paths
- Using diagrams and flowcharts effectively
- Providing confidence levels for each finding
- Referencing raw evidence: file paths, hashes, timestamps
- Documenting assumptions and limitations
- Creating appendices: full logs, tool output, commands
- Defensible language and avoiding speculation
- Peer review and validation of reports
- Presenting findings to executives and legal teams
- Preparing for cross-examination and Q&A
- Using report templates for consistency
- Automating report generation with scripts
- Archiving reports for long-term retention
Module 18: GIAC Certification Preparation and Career Advancement - Overview of the GIAC certification process: GCFE, GCFA, GXPN
- Detailed breakdown of the GCFE exam objectives
- Recommended study path and time allocation
- Practice exam strategies and time management
- Commonly tested forensic scenarios on the GCFE
- Hands-on lab preparation and simulation exercises
- Sample questions and explanation of correct answers
- Understanding GIAC’s practical exam format
- Submitting the certification application
- Maintaining certification through CPEs
- Adding your certification to LinkedIn and resumes
- Benchmarking skills against industry standards
- Salary trends for GIAC certified professionals
- Transitioning into advanced roles: DFIR, threat hunting, IR lead
- Leveraging your Certificate of Completion from The Art of Service
- Building a professional portfolio of forensic reports
- Networking with other forensic analysts and mentors
- Accessing exclusive job boards and hiring partners
- Preparing for leadership in security investigations
- Introduction to digital forensics: definitions, scope, and real-world impact
- Understanding the role of a forensic analyst in modern security teams
- Key legal and ethical considerations in digital investigations
- Chain of custody principles and documentation requirements
- Differentiating between incident response and digital forensics
- The NIST Incident Response Framework: phases and integration
- Incident classification: malware, insider threat, data exfiltration, ransomware
- Defining the investigative hypothesis: from alert to inquiry
- Understanding data volatility and evidence prioritisation
- Establishing a forensic workstation: hardware and software prerequisites
- Creating a secure, write-protected investigation environment
- Introduction to forensic soundness and admissibility standards
- Overview of common forensic challenges in enterprise environments
- Aligning forensic practices with regulatory requirements (GDPR, HIPAA, PCI DSS)
- Building a personal forensic toolkit: open-source and commercial options
Module 2: Legal and Regulatory Frameworks for Forensic Investigations - Federal rules of evidence and digital data admissibility
- Understanding the Daubert standard and its impact on forensic testimony
- Data privacy laws and their effect on forensic collection
- Cross-border data transfer and jurisdictional challenges
- Working with legal counsel during investigations
- Documentation standards for court-defensible reports
- When and how to issue legal holds
- The role of consent and authorisation in evidence acquisition
- Employee monitoring policies and forensic boundaries
- Reporting obligations under breach notification laws
- Handling personally identifiable information (PII) during analysis
- Audit trail requirements for digital evidence
- Forensic independence and avoiding conflicts of interest
- Using the FRE 901 standard for authentication of digital evidence
- Preparing for expert witness testimony
Module 3: Forensic Acquisition and Evidence Handling - Types of digital evidence: volatile, semi-volatile, non-volatile
- Live vs. dead acquisition: when to use each
- Best practices for acquiring RAM images using tools like DumpIt
- Disk imaging: bit-stream vs. logical captures
- Using dd, DCFLdd, and Guymager for reliable imaging
- Verifying integrity with MD5 and SHA-256 hash values
- Handling encrypted drives: full disk encryption strategies
- Imaging virtual machines and cloud instances
- Dealing with SSDs and TRIM: forensic challenges and mitigation
- Working with write blockers: hardware vs. software
- Creating portable forensic kits for field deployment
- Network-based acquisition and remote imaging
- Metadata preservation during collection
- Labelling and storing forensic images securely
- Documenting acquisition procedures for audit trails
- Automating acquisition workflows with scripting
Module 4: File System Fundamentals and NTFS Deep Dive - Overview of common file systems: FAT32, exFAT, NTFS, ext4, APFS
- Structure of NTFS: MFT, $Logfile, $Bitmap, $Boot
- Master File Table (MFT) analysis: parsing and interpretation
- Understanding file attributes: standard, extended, and resident
- File timestamps in NTFS: MACE times and their forensic significance
- Time zone handling and daylight saving time adjustments
- Timestomping detection and timeline reconstruction
- File fragmentation and its impact on recovery
- Alternate Data Streams (ADS) and their abuse in malware
- Recovering deleted files from MFT entries
- Volume Shadow Copy analysis and snapshot exploitation
- Disk slack and RAM slack: locating hidden data
- Unallocated space and file carving techniques
- NTFS permissions and access control lists (ACLs)
- Reconstructing file operations from journal entries
Module 5: Windows Registry Forensics - Overview of the Windows Registry structure: hives and keys
- Registry hives: SOFTWARE, SYSTEM, SAM, SECURITY, NTUSER.DAT
- Extracting and loading registry hives for analysis
- RecentAppCache and UserAssist: tracking user execution
- TypedPaths and OpenSaveMRU: user file interaction history
- USB device tracking: LastMountedVolume and USBStor keys
- Network connection history: NetworkList and Connections keys
- User profile creation and logon events in the Registry
- Persistence mechanisms: Run keys, services, and startup folders
- Program execution via Scheduled Tasks registry entries
- Jump lists and Automatic Destinations analysis
- SSP and Security Providers: detecting credential access
- AppCompatCache and ShimCache: detecting executed binaries
- AmCache.hve: forensic insights from program execution
- Timezone and system configuration data in SYSTEM hive
Module 6: Windows Event Log Analysis - Introduction to Windows Event Logs: XML structure and format
- Common log sources: Security, System, Application, PowerShell
- Event ID 4624: successful logons and session analysis
- Event ID 4625: failed logon attempts and brute force detection
- Event ID 4670: access permission changes and privilege escalation
- Event ID 4688: process creation and command-line logging
- Event ID 4697: service installation events
- Event ID 4720: account creation events
- Event ID 4738: account changes and lockout bypass
- Event ID 4740: account lockouts and their significance
- Event ID 4768–4771: Kerberos authentication flows
- PowerShell logging: Script Block, Module, and Transcription Logs
- Event log parsing with LogParser and PowerShell
- Timeline correlation across multiple event logs
- Detecting event log clearing and cover-up attempts
- Recovering deleted event logs from unallocated space
- Forwarded events and centralised logging forensic challenges
- Abuse of background tasks and WMI subscription events
Module 7: Memory Forensics with Volatility Framework - Introduction to memory forensics and its investigative value
- Understanding process address space and kernel memory
- Acquiring memory dumps from compromised systems
- Volatility 3 installation and configuration
- Identifying the correct profile for memory analysis
- Listing running processes and hidden malware
- Dumping malicious processes for external analysis
- Network connections and sockets: netstat equivalent
- Extracting command-line arguments from process memory
- Detecting process injection: hollowing, DLL injection
- Identifying rogue services and drivers
- Registry hives extraction from memory
- Recovering clipboard contents and user data
- Browser history and credential recovery from RAM
- Timeline reconstruction from memory artifacts
- Kernel callback inspection for rootkit detection
- Memory signature analysis for malware families
Module 8: Browser Forensics and Web Artifact Analysis - Overview of browser storage: cache, cookies, history, localStorage
- Chrome and Chromium-based browser forensics
- Reconstructing user browsing activity from History database
- Download tracking via Downloads database
- Recovering visited sites from Top Sites and Thumbnails
- Form data and autofill recovery from Web Data database
- Cookies analysis: session tracking and authentication tokens
- Extension analysis and malicious add-on detection
- IndexedDB and localStorage examination
- Firefox forensics: places.sqlite and cookies.sqlite
- Internet Explorer and Edge legacy artifact locations
- Incognito mode: myths and forensic reality
- Web-based email and cloud service identification
- Detecting data exfiltration via online forms
- Search engine query reconstruction
- Flash cookies and browser fingerprinting traces
- Extracting URLs from memory and prefetch
Module 9: Email and Communication Forensics - Forensic analysis of email clients: Outlook, Thunderbird
- Parsing PST and OST files for evidence
- Recovering deleted emails from PSTs
- SMTP headers analysis: tracking message origin
- Phishing email detection through header inspection
- Extracting attachments from email databases
- Metadata analysis in email content
- Chat forensics: Teams, Slack, WhatsApp, Signal
- Skype and VoIP call logging and recovery
- Social media account activity tracking
- Forensic implications of cloud-based messaging
- Recovering deleted messages from SQLite databases
- Timestamp alignment across communication platforms
- Detecting insider threat through messaging patterns
- Encryption and its impact on access to communications
Module 10: Malware Analysis and Reverse Engineering Fundamentals - Static vs. dynamic malware analysis: when to use each
- Safe execution environment setup: sandboxing principles
- Hashing and identifying known malware with VirusTotal
- Strings extraction and obfuscation detection
- File header analysis: PE structure and entropy
- Import Table analysis: identifying malicious API calls
- Packing detection and unpacking strategies
- Behavioral analysis: file, registry, process, network changes
- Dynamic analysis with Cuckoo and ANY.RUN
- Detecting persistence mechanisms in binaries
- Anti-analysis techniques: VM detection, debugger evasion
- Extracting C2 domains and IP addresses
- Logging network traffic with Wireshark and tcpdump
- API hooking and system call monitoring
- YARA rule creation for malware detection
- Producing actionable malware reports for IR teams
Module 11: Network Forensics and Packet Analysis - Introduction to network forensics and full packet capture
- TCP/IP fundamentals for forensic analysts
- Wireshark interface and display filtering
- Analyzing attack traffic: SYN floods, port scans, brute force
- Reconstructing HTTP sessions and file downloads
- Extracting images, documents, and credentials from captures
- DNS tunneling detection and investigation
- Identifying beaconing behavior in network streams
- SSL/TLS decryption with session keys from memory
- NetFlow and IPFIX analysis for large-scale monitoring
- Geolocating C2 servers from packet captures
- Detecting lateral movement through SMB and RDP
- VoIP call reconstruction from RTP streams
- Identifying encrypted channels and covert protocols
- Timeline correlation: aligning netflow with host events
- Using Zeek (formerly Bro) for automated log generation
Module 12: Timeline Analysis and Correlation - Building comprehensive timelines: super-timelines
- Timeline sources: file system, registry, logs, memory
- Creating timelines with Plaso and log2timeline
- Setting up evidence collection for timeline building
- Filtering and parsing timeline data effectively
- Using timezones and leap seconds correctly
- Identifying time gaps and anomalies in activity
- Correlating events across multiple hosts
- Detecting timestomping through anomaly detection
- Exporting timelines for reporting and visualisation
- Integrating timeline data with SIEM outputs
- Linking user activity to system events
- Highlighting critical windows of compromise
- Using timelines in court presentations
- Automating timeline updates during ongoing investigations
Module 13: Forensic Tools Mastery: FTK, Autopsy, and X-Ways - FTK Imager: disk imaging and previewing evidence
- Creating and managing cases in FTK
- Indexing and keyword searching at scale
- Hash filtering: identifying known good and bad files
- Email parsing and thread reconstruction in FTK
- Generating comprehensive reports from FTK
- Autopsy interface and case management
- Keyword and regular expression searches in Autopsy
- Using Kali Linux with Autopsy for advanced analysis
- File carving with Autopsy and Scalpel
- X-Ways Forensics: navigating the interface
- Template-based analysis and automation in X-Ways
- Volume cloning and comparison techniques
- Advanced search and data carving with X-Ways
- Registry and file system analysis in X-Ways
- Cross-verification of findings across multiple tools
- Optimising tool performance for large datasets
Module 14: Mobile Device Forensics - Physical, logical, and file system extraction methods
- iOS backup analysis: iTunes and iCloud
- Extracting data from iOS system files and databases
- Location data analysis: GPS, Wi-Fi, cell towers
- Call and message history recovery from SQLite
- Android ADB extraction and root access methods
- Analysing app data: WhatsApp, Telegram, Signal
- Browsing history and search activity on mobile
- Cloud sync forensics: Google Drive, iCloud, Dropbox
- Mobile malware indicators and detection
- Lock screen bypass and encryption considerations
- Bluetooth and pairing history analysis
- Using Magnet AXIOM and Cellebrite (conceptual workflow)
- Reporting on mobile evidence in investigations
- Legal considerations in mobile seizures
Module 15: Cloud and Virtual Environment Forensics - Challenges of cloud forensics: data ownership and access
- Understanding shared responsibility models (AWS, Azure, GCP)
- Acquiring evidence from S3 buckets and blob storage
- CloudTrail, Azure Monitor, and Cloud Audit Logs analysis
- Identifying suspicious API calls and privilege escalation
- Virtual machine memory and disk acquisition
- Snapshot forensics in virtual environments
- Detecting VM escape and hypervisor compromise
- Container forensics: Docker and Kubernetes artifact recovery
- Serverless function logs and execution traces
- Logging and monitoring in hybrid cloud environments
- Incident response playbooks for cloud-native attacks
- Using native cloud tools for evidence collection
- Timeline alignment across distributed services
- Preserving chain of custody in cloud investigations
Module 16: Incident Response Playbook Development - Designing incident response playbooks for common scenarios
- Structure of a playbook: objectives, steps, tools, escalation
- Playbook for ransomware: detection, containment, recovery
- Insider threat playbook: data access, exfiltration, detection
- Phishing and credential compromise response workflow
- Malware outbreak: containment and eradication steps
- Privilege escalation and lateral movement playbook
- Cloud account compromise: MFA bypass, API misuse
- Incident declaration criteria and severity classification
- Roles and responsibilities during an incident
- Communication templates: internal, legal, public
- Integration with SOAR platforms and ticketing systems
- Testing playbooks through tabletop exercises
- Version control and update procedures for playbooks
- Organising playbooks by MITRE ATT&CK technique
Module 17: Reporting and Presenting Forensic Findings - Structure of a forensic report: executive summary, methodology, findings
- Writing for technical and non-technical audiences
- Visualising timelines and attack paths
- Using diagrams and flowcharts effectively
- Providing confidence levels for each finding
- Referencing raw evidence: file paths, hashes, timestamps
- Documenting assumptions and limitations
- Creating appendices: full logs, tool output, commands
- Defensible language and avoiding speculation
- Peer review and validation of reports
- Presenting findings to executives and legal teams
- Preparing for cross-examination and Q&A
- Using report templates for consistency
- Automating report generation with scripts
- Archiving reports for long-term retention
Module 18: GIAC Certification Preparation and Career Advancement - Overview of the GIAC certification process: GCFE, GCFA, GXPN
- Detailed breakdown of the GCFE exam objectives
- Recommended study path and time allocation
- Practice exam strategies and time management
- Commonly tested forensic scenarios on the GCFE
- Hands-on lab preparation and simulation exercises
- Sample questions and explanation of correct answers
- Understanding GIAC’s practical exam format
- Submitting the certification application
- Maintaining certification through CPEs
- Adding your certification to LinkedIn and resumes
- Benchmarking skills against industry standards
- Salary trends for GIAC certified professionals
- Transitioning into advanced roles: DFIR, threat hunting, IR lead
- Leveraging your Certificate of Completion from The Art of Service
- Building a professional portfolio of forensic reports
- Networking with other forensic analysts and mentors
- Accessing exclusive job boards and hiring partners
- Preparing for leadership in security investigations
- Types of digital evidence: volatile, semi-volatile, non-volatile
- Live vs. dead acquisition: when to use each
- Best practices for acquiring RAM images using tools like DumpIt
- Disk imaging: bit-stream vs. logical captures
- Using dd, DCFLdd, and Guymager for reliable imaging
- Verifying integrity with MD5 and SHA-256 hash values
- Handling encrypted drives: full disk encryption strategies
- Imaging virtual machines and cloud instances
- Dealing with SSDs and TRIM: forensic challenges and mitigation
- Working with write blockers: hardware vs. software
- Creating portable forensic kits for field deployment
- Network-based acquisition and remote imaging
- Metadata preservation during collection
- Labelling and storing forensic images securely
- Documenting acquisition procedures for audit trails
- Automating acquisition workflows with scripting
Module 4: File System Fundamentals and NTFS Deep Dive - Overview of common file systems: FAT32, exFAT, NTFS, ext4, APFS
- Structure of NTFS: MFT, $Logfile, $Bitmap, $Boot
- Master File Table (MFT) analysis: parsing and interpretation
- Understanding file attributes: standard, extended, and resident
- File timestamps in NTFS: MACE times and their forensic significance
- Time zone handling and daylight saving time adjustments
- Timestomping detection and timeline reconstruction
- File fragmentation and its impact on recovery
- Alternate Data Streams (ADS) and their abuse in malware
- Recovering deleted files from MFT entries
- Volume Shadow Copy analysis and snapshot exploitation
- Disk slack and RAM slack: locating hidden data
- Unallocated space and file carving techniques
- NTFS permissions and access control lists (ACLs)
- Reconstructing file operations from journal entries
Module 5: Windows Registry Forensics - Overview of the Windows Registry structure: hives and keys
- Registry hives: SOFTWARE, SYSTEM, SAM, SECURITY, NTUSER.DAT
- Extracting and loading registry hives for analysis
- RecentAppCache and UserAssist: tracking user execution
- TypedPaths and OpenSaveMRU: user file interaction history
- USB device tracking: LastMountedVolume and USBStor keys
- Network connection history: NetworkList and Connections keys
- User profile creation and logon events in the Registry
- Persistence mechanisms: Run keys, services, and startup folders
- Program execution via Scheduled Tasks registry entries
- Jump lists and Automatic Destinations analysis
- SSP and Security Providers: detecting credential access
- AppCompatCache and ShimCache: detecting executed binaries
- AmCache.hve: forensic insights from program execution
- Timezone and system configuration data in SYSTEM hive
Module 6: Windows Event Log Analysis - Introduction to Windows Event Logs: XML structure and format
- Common log sources: Security, System, Application, PowerShell
- Event ID 4624: successful logons and session analysis
- Event ID 4625: failed logon attempts and brute force detection
- Event ID 4670: access permission changes and privilege escalation
- Event ID 4688: process creation and command-line logging
- Event ID 4697: service installation events
- Event ID 4720: account creation events
- Event ID 4738: account changes and lockout bypass
- Event ID 4740: account lockouts and their significance
- Event ID 4768–4771: Kerberos authentication flows
- PowerShell logging: Script Block, Module, and Transcription Logs
- Event log parsing with LogParser and PowerShell
- Timeline correlation across multiple event logs
- Detecting event log clearing and cover-up attempts
- Recovering deleted event logs from unallocated space
- Forwarded events and centralised logging forensic challenges
- Abuse of background tasks and WMI subscription events
Module 7: Memory Forensics with Volatility Framework - Introduction to memory forensics and its investigative value
- Understanding process address space and kernel memory
- Acquiring memory dumps from compromised systems
- Volatility 3 installation and configuration
- Identifying the correct profile for memory analysis
- Listing running processes and hidden malware
- Dumping malicious processes for external analysis
- Network connections and sockets: netstat equivalent
- Extracting command-line arguments from process memory
- Detecting process injection: hollowing, DLL injection
- Identifying rogue services and drivers
- Registry hives extraction from memory
- Recovering clipboard contents and user data
- Browser history and credential recovery from RAM
- Timeline reconstruction from memory artifacts
- Kernel callback inspection for rootkit detection
- Memory signature analysis for malware families
Module 8: Browser Forensics and Web Artifact Analysis - Overview of browser storage: cache, cookies, history, localStorage
- Chrome and Chromium-based browser forensics
- Reconstructing user browsing activity from History database
- Download tracking via Downloads database
- Recovering visited sites from Top Sites and Thumbnails
- Form data and autofill recovery from Web Data database
- Cookies analysis: session tracking and authentication tokens
- Extension analysis and malicious add-on detection
- IndexedDB and localStorage examination
- Firefox forensics: places.sqlite and cookies.sqlite
- Internet Explorer and Edge legacy artifact locations
- Incognito mode: myths and forensic reality
- Web-based email and cloud service identification
- Detecting data exfiltration via online forms
- Search engine query reconstruction
- Flash cookies and browser fingerprinting traces
- Extracting URLs from memory and prefetch
Module 9: Email and Communication Forensics - Forensic analysis of email clients: Outlook, Thunderbird
- Parsing PST and OST files for evidence
- Recovering deleted emails from PSTs
- SMTP headers analysis: tracking message origin
- Phishing email detection through header inspection
- Extracting attachments from email databases
- Metadata analysis in email content
- Chat forensics: Teams, Slack, WhatsApp, Signal
- Skype and VoIP call logging and recovery
- Social media account activity tracking
- Forensic implications of cloud-based messaging
- Recovering deleted messages from SQLite databases
- Timestamp alignment across communication platforms
- Detecting insider threat through messaging patterns
- Encryption and its impact on access to communications
Module 10: Malware Analysis and Reverse Engineering Fundamentals - Static vs. dynamic malware analysis: when to use each
- Safe execution environment setup: sandboxing principles
- Hashing and identifying known malware with VirusTotal
- Strings extraction and obfuscation detection
- File header analysis: PE structure and entropy
- Import Table analysis: identifying malicious API calls
- Packing detection and unpacking strategies
- Behavioral analysis: file, registry, process, network changes
- Dynamic analysis with Cuckoo and ANY.RUN
- Detecting persistence mechanisms in binaries
- Anti-analysis techniques: VM detection, debugger evasion
- Extracting C2 domains and IP addresses
- Logging network traffic with Wireshark and tcpdump
- API hooking and system call monitoring
- YARA rule creation for malware detection
- Producing actionable malware reports for IR teams
Module 11: Network Forensics and Packet Analysis - Introduction to network forensics and full packet capture
- TCP/IP fundamentals for forensic analysts
- Wireshark interface and display filtering
- Analyzing attack traffic: SYN floods, port scans, brute force
- Reconstructing HTTP sessions and file downloads
- Extracting images, documents, and credentials from captures
- DNS tunneling detection and investigation
- Identifying beaconing behavior in network streams
- SSL/TLS decryption with session keys from memory
- NetFlow and IPFIX analysis for large-scale monitoring
- Geolocating C2 servers from packet captures
- Detecting lateral movement through SMB and RDP
- VoIP call reconstruction from RTP streams
- Identifying encrypted channels and covert protocols
- Timeline correlation: aligning netflow with host events
- Using Zeek (formerly Bro) for automated log generation
Module 12: Timeline Analysis and Correlation - Building comprehensive timelines: super-timelines
- Timeline sources: file system, registry, logs, memory
- Creating timelines with Plaso and log2timeline
- Setting up evidence collection for timeline building
- Filtering and parsing timeline data effectively
- Using timezones and leap seconds correctly
- Identifying time gaps and anomalies in activity
- Correlating events across multiple hosts
- Detecting timestomping through anomaly detection
- Exporting timelines for reporting and visualisation
- Integrating timeline data with SIEM outputs
- Linking user activity to system events
- Highlighting critical windows of compromise
- Using timelines in court presentations
- Automating timeline updates during ongoing investigations
Module 13: Forensic Tools Mastery: FTK, Autopsy, and X-Ways - FTK Imager: disk imaging and previewing evidence
- Creating and managing cases in FTK
- Indexing and keyword searching at scale
- Hash filtering: identifying known good and bad files
- Email parsing and thread reconstruction in FTK
- Generating comprehensive reports from FTK
- Autopsy interface and case management
- Keyword and regular expression searches in Autopsy
- Using Kali Linux with Autopsy for advanced analysis
- File carving with Autopsy and Scalpel
- X-Ways Forensics: navigating the interface
- Template-based analysis and automation in X-Ways
- Volume cloning and comparison techniques
- Advanced search and data carving with X-Ways
- Registry and file system analysis in X-Ways
- Cross-verification of findings across multiple tools
- Optimising tool performance for large datasets
Module 14: Mobile Device Forensics - Physical, logical, and file system extraction methods
- iOS backup analysis: iTunes and iCloud
- Extracting data from iOS system files and databases
- Location data analysis: GPS, Wi-Fi, cell towers
- Call and message history recovery from SQLite
- Android ADB extraction and root access methods
- Analysing app data: WhatsApp, Telegram, Signal
- Browsing history and search activity on mobile
- Cloud sync forensics: Google Drive, iCloud, Dropbox
- Mobile malware indicators and detection
- Lock screen bypass and encryption considerations
- Bluetooth and pairing history analysis
- Using Magnet AXIOM and Cellebrite (conceptual workflow)
- Reporting on mobile evidence in investigations
- Legal considerations in mobile seizures
Module 15: Cloud and Virtual Environment Forensics - Challenges of cloud forensics: data ownership and access
- Understanding shared responsibility models (AWS, Azure, GCP)
- Acquiring evidence from S3 buckets and blob storage
- CloudTrail, Azure Monitor, and Cloud Audit Logs analysis
- Identifying suspicious API calls and privilege escalation
- Virtual machine memory and disk acquisition
- Snapshot forensics in virtual environments
- Detecting VM escape and hypervisor compromise
- Container forensics: Docker and Kubernetes artifact recovery
- Serverless function logs and execution traces
- Logging and monitoring in hybrid cloud environments
- Incident response playbooks for cloud-native attacks
- Using native cloud tools for evidence collection
- Timeline alignment across distributed services
- Preserving chain of custody in cloud investigations
Module 16: Incident Response Playbook Development - Designing incident response playbooks for common scenarios
- Structure of a playbook: objectives, steps, tools, escalation
- Playbook for ransomware: detection, containment, recovery
- Insider threat playbook: data access, exfiltration, detection
- Phishing and credential compromise response workflow
- Malware outbreak: containment and eradication steps
- Privilege escalation and lateral movement playbook
- Cloud account compromise: MFA bypass, API misuse
- Incident declaration criteria and severity classification
- Roles and responsibilities during an incident
- Communication templates: internal, legal, public
- Integration with SOAR platforms and ticketing systems
- Testing playbooks through tabletop exercises
- Version control and update procedures for playbooks
- Organising playbooks by MITRE ATT&CK technique
Module 17: Reporting and Presenting Forensic Findings - Structure of a forensic report: executive summary, methodology, findings
- Writing for technical and non-technical audiences
- Visualising timelines and attack paths
- Using diagrams and flowcharts effectively
- Providing confidence levels for each finding
- Referencing raw evidence: file paths, hashes, timestamps
- Documenting assumptions and limitations
- Creating appendices: full logs, tool output, commands
- Defensible language and avoiding speculation
- Peer review and validation of reports
- Presenting findings to executives and legal teams
- Preparing for cross-examination and Q&A
- Using report templates for consistency
- Automating report generation with scripts
- Archiving reports for long-term retention
Module 18: GIAC Certification Preparation and Career Advancement - Overview of the GIAC certification process: GCFE, GCFA, GXPN
- Detailed breakdown of the GCFE exam objectives
- Recommended study path and time allocation
- Practice exam strategies and time management
- Commonly tested forensic scenarios on the GCFE
- Hands-on lab preparation and simulation exercises
- Sample questions and explanation of correct answers
- Understanding GIAC’s practical exam format
- Submitting the certification application
- Maintaining certification through CPEs
- Adding your certification to LinkedIn and resumes
- Benchmarking skills against industry standards
- Salary trends for GIAC certified professionals
- Transitioning into advanced roles: DFIR, threat hunting, IR lead
- Leveraging your Certificate of Completion from The Art of Service
- Building a professional portfolio of forensic reports
- Networking with other forensic analysts and mentors
- Accessing exclusive job boards and hiring partners
- Preparing for leadership in security investigations
- Overview of the Windows Registry structure: hives and keys
- Registry hives: SOFTWARE, SYSTEM, SAM, SECURITY, NTUSER.DAT
- Extracting and loading registry hives for analysis
- RecentAppCache and UserAssist: tracking user execution
- TypedPaths and OpenSaveMRU: user file interaction history
- USB device tracking: LastMountedVolume and USBStor keys
- Network connection history: NetworkList and Connections keys
- User profile creation and logon events in the Registry
- Persistence mechanisms: Run keys, services, and startup folders
- Program execution via Scheduled Tasks registry entries
- Jump lists and Automatic Destinations analysis
- SSP and Security Providers: detecting credential access
- AppCompatCache and ShimCache: detecting executed binaries
- AmCache.hve: forensic insights from program execution
- Timezone and system configuration data in SYSTEM hive
Module 6: Windows Event Log Analysis - Introduction to Windows Event Logs: XML structure and format
- Common log sources: Security, System, Application, PowerShell
- Event ID 4624: successful logons and session analysis
- Event ID 4625: failed logon attempts and brute force detection
- Event ID 4670: access permission changes and privilege escalation
- Event ID 4688: process creation and command-line logging
- Event ID 4697: service installation events
- Event ID 4720: account creation events
- Event ID 4738: account changes and lockout bypass
- Event ID 4740: account lockouts and their significance
- Event ID 4768–4771: Kerberos authentication flows
- PowerShell logging: Script Block, Module, and Transcription Logs
- Event log parsing with LogParser and PowerShell
- Timeline correlation across multiple event logs
- Detecting event log clearing and cover-up attempts
- Recovering deleted event logs from unallocated space
- Forwarded events and centralised logging forensic challenges
- Abuse of background tasks and WMI subscription events
Module 7: Memory Forensics with Volatility Framework - Introduction to memory forensics and its investigative value
- Understanding process address space and kernel memory
- Acquiring memory dumps from compromised systems
- Volatility 3 installation and configuration
- Identifying the correct profile for memory analysis
- Listing running processes and hidden malware
- Dumping malicious processes for external analysis
- Network connections and sockets: netstat equivalent
- Extracting command-line arguments from process memory
- Detecting process injection: hollowing, DLL injection
- Identifying rogue services and drivers
- Registry hives extraction from memory
- Recovering clipboard contents and user data
- Browser history and credential recovery from RAM
- Timeline reconstruction from memory artifacts
- Kernel callback inspection for rootkit detection
- Memory signature analysis for malware families
Module 8: Browser Forensics and Web Artifact Analysis - Overview of browser storage: cache, cookies, history, localStorage
- Chrome and Chromium-based browser forensics
- Reconstructing user browsing activity from History database
- Download tracking via Downloads database
- Recovering visited sites from Top Sites and Thumbnails
- Form data and autofill recovery from Web Data database
- Cookies analysis: session tracking and authentication tokens
- Extension analysis and malicious add-on detection
- IndexedDB and localStorage examination
- Firefox forensics: places.sqlite and cookies.sqlite
- Internet Explorer and Edge legacy artifact locations
- Incognito mode: myths and forensic reality
- Web-based email and cloud service identification
- Detecting data exfiltration via online forms
- Search engine query reconstruction
- Flash cookies and browser fingerprinting traces
- Extracting URLs from memory and prefetch
Module 9: Email and Communication Forensics - Forensic analysis of email clients: Outlook, Thunderbird
- Parsing PST and OST files for evidence
- Recovering deleted emails from PSTs
- SMTP headers analysis: tracking message origin
- Phishing email detection through header inspection
- Extracting attachments from email databases
- Metadata analysis in email content
- Chat forensics: Teams, Slack, WhatsApp, Signal
- Skype and VoIP call logging and recovery
- Social media account activity tracking
- Forensic implications of cloud-based messaging
- Recovering deleted messages from SQLite databases
- Timestamp alignment across communication platforms
- Detecting insider threat through messaging patterns
- Encryption and its impact on access to communications
Module 10: Malware Analysis and Reverse Engineering Fundamentals - Static vs. dynamic malware analysis: when to use each
- Safe execution environment setup: sandboxing principles
- Hashing and identifying known malware with VirusTotal
- Strings extraction and obfuscation detection
- File header analysis: PE structure and entropy
- Import Table analysis: identifying malicious API calls
- Packing detection and unpacking strategies
- Behavioral analysis: file, registry, process, network changes
- Dynamic analysis with Cuckoo and ANY.RUN
- Detecting persistence mechanisms in binaries
- Anti-analysis techniques: VM detection, debugger evasion
- Extracting C2 domains and IP addresses
- Logging network traffic with Wireshark and tcpdump
- API hooking and system call monitoring
- YARA rule creation for malware detection
- Producing actionable malware reports for IR teams
Module 11: Network Forensics and Packet Analysis - Introduction to network forensics and full packet capture
- TCP/IP fundamentals for forensic analysts
- Wireshark interface and display filtering
- Analyzing attack traffic: SYN floods, port scans, brute force
- Reconstructing HTTP sessions and file downloads
- Extracting images, documents, and credentials from captures
- DNS tunneling detection and investigation
- Identifying beaconing behavior in network streams
- SSL/TLS decryption with session keys from memory
- NetFlow and IPFIX analysis for large-scale monitoring
- Geolocating C2 servers from packet captures
- Detecting lateral movement through SMB and RDP
- VoIP call reconstruction from RTP streams
- Identifying encrypted channels and covert protocols
- Timeline correlation: aligning netflow with host events
- Using Zeek (formerly Bro) for automated log generation
Module 12: Timeline Analysis and Correlation - Building comprehensive timelines: super-timelines
- Timeline sources: file system, registry, logs, memory
- Creating timelines with Plaso and log2timeline
- Setting up evidence collection for timeline building
- Filtering and parsing timeline data effectively
- Using timezones and leap seconds correctly
- Identifying time gaps and anomalies in activity
- Correlating events across multiple hosts
- Detecting timestomping through anomaly detection
- Exporting timelines for reporting and visualisation
- Integrating timeline data with SIEM outputs
- Linking user activity to system events
- Highlighting critical windows of compromise
- Using timelines in court presentations
- Automating timeline updates during ongoing investigations
Module 13: Forensic Tools Mastery: FTK, Autopsy, and X-Ways - FTK Imager: disk imaging and previewing evidence
- Creating and managing cases in FTK
- Indexing and keyword searching at scale
- Hash filtering: identifying known good and bad files
- Email parsing and thread reconstruction in FTK
- Generating comprehensive reports from FTK
- Autopsy interface and case management
- Keyword and regular expression searches in Autopsy
- Using Kali Linux with Autopsy for advanced analysis
- File carving with Autopsy and Scalpel
- X-Ways Forensics: navigating the interface
- Template-based analysis and automation in X-Ways
- Volume cloning and comparison techniques
- Advanced search and data carving with X-Ways
- Registry and file system analysis in X-Ways
- Cross-verification of findings across multiple tools
- Optimising tool performance for large datasets
Module 14: Mobile Device Forensics - Physical, logical, and file system extraction methods
- iOS backup analysis: iTunes and iCloud
- Extracting data from iOS system files and databases
- Location data analysis: GPS, Wi-Fi, cell towers
- Call and message history recovery from SQLite
- Android ADB extraction and root access methods
- Analysing app data: WhatsApp, Telegram, Signal
- Browsing history and search activity on mobile
- Cloud sync forensics: Google Drive, iCloud, Dropbox
- Mobile malware indicators and detection
- Lock screen bypass and encryption considerations
- Bluetooth and pairing history analysis
- Using Magnet AXIOM and Cellebrite (conceptual workflow)
- Reporting on mobile evidence in investigations
- Legal considerations in mobile seizures
Module 15: Cloud and Virtual Environment Forensics - Challenges of cloud forensics: data ownership and access
- Understanding shared responsibility models (AWS, Azure, GCP)
- Acquiring evidence from S3 buckets and blob storage
- CloudTrail, Azure Monitor, and Cloud Audit Logs analysis
- Identifying suspicious API calls and privilege escalation
- Virtual machine memory and disk acquisition
- Snapshot forensics in virtual environments
- Detecting VM escape and hypervisor compromise
- Container forensics: Docker and Kubernetes artifact recovery
- Serverless function logs and execution traces
- Logging and monitoring in hybrid cloud environments
- Incident response playbooks for cloud-native attacks
- Using native cloud tools for evidence collection
- Timeline alignment across distributed services
- Preserving chain of custody in cloud investigations
Module 16: Incident Response Playbook Development - Designing incident response playbooks for common scenarios
- Structure of a playbook: objectives, steps, tools, escalation
- Playbook for ransomware: detection, containment, recovery
- Insider threat playbook: data access, exfiltration, detection
- Phishing and credential compromise response workflow
- Malware outbreak: containment and eradication steps
- Privilege escalation and lateral movement playbook
- Cloud account compromise: MFA bypass, API misuse
- Incident declaration criteria and severity classification
- Roles and responsibilities during an incident
- Communication templates: internal, legal, public
- Integration with SOAR platforms and ticketing systems
- Testing playbooks through tabletop exercises
- Version control and update procedures for playbooks
- Organising playbooks by MITRE ATT&CK technique
Module 17: Reporting and Presenting Forensic Findings - Structure of a forensic report: executive summary, methodology, findings
- Writing for technical and non-technical audiences
- Visualising timelines and attack paths
- Using diagrams and flowcharts effectively
- Providing confidence levels for each finding
- Referencing raw evidence: file paths, hashes, timestamps
- Documenting assumptions and limitations
- Creating appendices: full logs, tool output, commands
- Defensible language and avoiding speculation
- Peer review and validation of reports
- Presenting findings to executives and legal teams
- Preparing for cross-examination and Q&A
- Using report templates for consistency
- Automating report generation with scripts
- Archiving reports for long-term retention
Module 18: GIAC Certification Preparation and Career Advancement - Overview of the GIAC certification process: GCFE, GCFA, GXPN
- Detailed breakdown of the GCFE exam objectives
- Recommended study path and time allocation
- Practice exam strategies and time management
- Commonly tested forensic scenarios on the GCFE
- Hands-on lab preparation and simulation exercises
- Sample questions and explanation of correct answers
- Understanding GIAC’s practical exam format
- Submitting the certification application
- Maintaining certification through CPEs
- Adding your certification to LinkedIn and resumes
- Benchmarking skills against industry standards
- Salary trends for GIAC certified professionals
- Transitioning into advanced roles: DFIR, threat hunting, IR lead
- Leveraging your Certificate of Completion from The Art of Service
- Building a professional portfolio of forensic reports
- Networking with other forensic analysts and mentors
- Accessing exclusive job boards and hiring partners
- Preparing for leadership in security investigations
- Introduction to memory forensics and its investigative value
- Understanding process address space and kernel memory
- Acquiring memory dumps from compromised systems
- Volatility 3 installation and configuration
- Identifying the correct profile for memory analysis
- Listing running processes and hidden malware
- Dumping malicious processes for external analysis
- Network connections and sockets: netstat equivalent
- Extracting command-line arguments from process memory
- Detecting process injection: hollowing, DLL injection
- Identifying rogue services and drivers
- Registry hives extraction from memory
- Recovering clipboard contents and user data
- Browser history and credential recovery from RAM
- Timeline reconstruction from memory artifacts
- Kernel callback inspection for rootkit detection
- Memory signature analysis for malware families
Module 8: Browser Forensics and Web Artifact Analysis - Overview of browser storage: cache, cookies, history, localStorage
- Chrome and Chromium-based browser forensics
- Reconstructing user browsing activity from History database
- Download tracking via Downloads database
- Recovering visited sites from Top Sites and Thumbnails
- Form data and autofill recovery from Web Data database
- Cookies analysis: session tracking and authentication tokens
- Extension analysis and malicious add-on detection
- IndexedDB and localStorage examination
- Firefox forensics: places.sqlite and cookies.sqlite
- Internet Explorer and Edge legacy artifact locations
- Incognito mode: myths and forensic reality
- Web-based email and cloud service identification
- Detecting data exfiltration via online forms
- Search engine query reconstruction
- Flash cookies and browser fingerprinting traces
- Extracting URLs from memory and prefetch
Module 9: Email and Communication Forensics - Forensic analysis of email clients: Outlook, Thunderbird
- Parsing PST and OST files for evidence
- Recovering deleted emails from PSTs
- SMTP headers analysis: tracking message origin
- Phishing email detection through header inspection
- Extracting attachments from email databases
- Metadata analysis in email content
- Chat forensics: Teams, Slack, WhatsApp, Signal
- Skype and VoIP call logging and recovery
- Social media account activity tracking
- Forensic implications of cloud-based messaging
- Recovering deleted messages from SQLite databases
- Timestamp alignment across communication platforms
- Detecting insider threat through messaging patterns
- Encryption and its impact on access to communications
Module 10: Malware Analysis and Reverse Engineering Fundamentals - Static vs. dynamic malware analysis: when to use each
- Safe execution environment setup: sandboxing principles
- Hashing and identifying known malware with VirusTotal
- Strings extraction and obfuscation detection
- File header analysis: PE structure and entropy
- Import Table analysis: identifying malicious API calls
- Packing detection and unpacking strategies
- Behavioral analysis: file, registry, process, network changes
- Dynamic analysis with Cuckoo and ANY.RUN
- Detecting persistence mechanisms in binaries
- Anti-analysis techniques: VM detection, debugger evasion
- Extracting C2 domains and IP addresses
- Logging network traffic with Wireshark and tcpdump
- API hooking and system call monitoring
- YARA rule creation for malware detection
- Producing actionable malware reports for IR teams
Module 11: Network Forensics and Packet Analysis - Introduction to network forensics and full packet capture
- TCP/IP fundamentals for forensic analysts
- Wireshark interface and display filtering
- Analyzing attack traffic: SYN floods, port scans, brute force
- Reconstructing HTTP sessions and file downloads
- Extracting images, documents, and credentials from captures
- DNS tunneling detection and investigation
- Identifying beaconing behavior in network streams
- SSL/TLS decryption with session keys from memory
- NetFlow and IPFIX analysis for large-scale monitoring
- Geolocating C2 servers from packet captures
- Detecting lateral movement through SMB and RDP
- VoIP call reconstruction from RTP streams
- Identifying encrypted channels and covert protocols
- Timeline correlation: aligning netflow with host events
- Using Zeek (formerly Bro) for automated log generation
Module 12: Timeline Analysis and Correlation - Building comprehensive timelines: super-timelines
- Timeline sources: file system, registry, logs, memory
- Creating timelines with Plaso and log2timeline
- Setting up evidence collection for timeline building
- Filtering and parsing timeline data effectively
- Using timezones and leap seconds correctly
- Identifying time gaps and anomalies in activity
- Correlating events across multiple hosts
- Detecting timestomping through anomaly detection
- Exporting timelines for reporting and visualisation
- Integrating timeline data with SIEM outputs
- Linking user activity to system events
- Highlighting critical windows of compromise
- Using timelines in court presentations
- Automating timeline updates during ongoing investigations
Module 13: Forensic Tools Mastery: FTK, Autopsy, and X-Ways - FTK Imager: disk imaging and previewing evidence
- Creating and managing cases in FTK
- Indexing and keyword searching at scale
- Hash filtering: identifying known good and bad files
- Email parsing and thread reconstruction in FTK
- Generating comprehensive reports from FTK
- Autopsy interface and case management
- Keyword and regular expression searches in Autopsy
- Using Kali Linux with Autopsy for advanced analysis
- File carving with Autopsy and Scalpel
- X-Ways Forensics: navigating the interface
- Template-based analysis and automation in X-Ways
- Volume cloning and comparison techniques
- Advanced search and data carving with X-Ways
- Registry and file system analysis in X-Ways
- Cross-verification of findings across multiple tools
- Optimising tool performance for large datasets
Module 14: Mobile Device Forensics - Physical, logical, and file system extraction methods
- iOS backup analysis: iTunes and iCloud
- Extracting data from iOS system files and databases
- Location data analysis: GPS, Wi-Fi, cell towers
- Call and message history recovery from SQLite
- Android ADB extraction and root access methods
- Analysing app data: WhatsApp, Telegram, Signal
- Browsing history and search activity on mobile
- Cloud sync forensics: Google Drive, iCloud, Dropbox
- Mobile malware indicators and detection
- Lock screen bypass and encryption considerations
- Bluetooth and pairing history analysis
- Using Magnet AXIOM and Cellebrite (conceptual workflow)
- Reporting on mobile evidence in investigations
- Legal considerations in mobile seizures
Module 15: Cloud and Virtual Environment Forensics - Challenges of cloud forensics: data ownership and access
- Understanding shared responsibility models (AWS, Azure, GCP)
- Acquiring evidence from S3 buckets and blob storage
- CloudTrail, Azure Monitor, and Cloud Audit Logs analysis
- Identifying suspicious API calls and privilege escalation
- Virtual machine memory and disk acquisition
- Snapshot forensics in virtual environments
- Detecting VM escape and hypervisor compromise
- Container forensics: Docker and Kubernetes artifact recovery
- Serverless function logs and execution traces
- Logging and monitoring in hybrid cloud environments
- Incident response playbooks for cloud-native attacks
- Using native cloud tools for evidence collection
- Timeline alignment across distributed services
- Preserving chain of custody in cloud investigations
Module 16: Incident Response Playbook Development - Designing incident response playbooks for common scenarios
- Structure of a playbook: objectives, steps, tools, escalation
- Playbook for ransomware: detection, containment, recovery
- Insider threat playbook: data access, exfiltration, detection
- Phishing and credential compromise response workflow
- Malware outbreak: containment and eradication steps
- Privilege escalation and lateral movement playbook
- Cloud account compromise: MFA bypass, API misuse
- Incident declaration criteria and severity classification
- Roles and responsibilities during an incident
- Communication templates: internal, legal, public
- Integration with SOAR platforms and ticketing systems
- Testing playbooks through tabletop exercises
- Version control and update procedures for playbooks
- Organising playbooks by MITRE ATT&CK technique
Module 17: Reporting and Presenting Forensic Findings - Structure of a forensic report: executive summary, methodology, findings
- Writing for technical and non-technical audiences
- Visualising timelines and attack paths
- Using diagrams and flowcharts effectively
- Providing confidence levels for each finding
- Referencing raw evidence: file paths, hashes, timestamps
- Documenting assumptions and limitations
- Creating appendices: full logs, tool output, commands
- Defensible language and avoiding speculation
- Peer review and validation of reports
- Presenting findings to executives and legal teams
- Preparing for cross-examination and Q&A
- Using report templates for consistency
- Automating report generation with scripts
- Archiving reports for long-term retention
Module 18: GIAC Certification Preparation and Career Advancement - Overview of the GIAC certification process: GCFE, GCFA, GXPN
- Detailed breakdown of the GCFE exam objectives
- Recommended study path and time allocation
- Practice exam strategies and time management
- Commonly tested forensic scenarios on the GCFE
- Hands-on lab preparation and simulation exercises
- Sample questions and explanation of correct answers
- Understanding GIAC’s practical exam format
- Submitting the certification application
- Maintaining certification through CPEs
- Adding your certification to LinkedIn and resumes
- Benchmarking skills against industry standards
- Salary trends for GIAC certified professionals
- Transitioning into advanced roles: DFIR, threat hunting, IR lead
- Leveraging your Certificate of Completion from The Art of Service
- Building a professional portfolio of forensic reports
- Networking with other forensic analysts and mentors
- Accessing exclusive job boards and hiring partners
- Preparing for leadership in security investigations
- Forensic analysis of email clients: Outlook, Thunderbird
- Parsing PST and OST files for evidence
- Recovering deleted emails from PSTs
- SMTP headers analysis: tracking message origin
- Phishing email detection through header inspection
- Extracting attachments from email databases
- Metadata analysis in email content
- Chat forensics: Teams, Slack, WhatsApp, Signal
- Skype and VoIP call logging and recovery
- Social media account activity tracking
- Forensic implications of cloud-based messaging
- Recovering deleted messages from SQLite databases
- Timestamp alignment across communication platforms
- Detecting insider threat through messaging patterns
- Encryption and its impact on access to communications
Module 10: Malware Analysis and Reverse Engineering Fundamentals - Static vs. dynamic malware analysis: when to use each
- Safe execution environment setup: sandboxing principles
- Hashing and identifying known malware with VirusTotal
- Strings extraction and obfuscation detection
- File header analysis: PE structure and entropy
- Import Table analysis: identifying malicious API calls
- Packing detection and unpacking strategies
- Behavioral analysis: file, registry, process, network changes
- Dynamic analysis with Cuckoo and ANY.RUN
- Detecting persistence mechanisms in binaries
- Anti-analysis techniques: VM detection, debugger evasion
- Extracting C2 domains and IP addresses
- Logging network traffic with Wireshark and tcpdump
- API hooking and system call monitoring
- YARA rule creation for malware detection
- Producing actionable malware reports for IR teams
Module 11: Network Forensics and Packet Analysis - Introduction to network forensics and full packet capture
- TCP/IP fundamentals for forensic analysts
- Wireshark interface and display filtering
- Analyzing attack traffic: SYN floods, port scans, brute force
- Reconstructing HTTP sessions and file downloads
- Extracting images, documents, and credentials from captures
- DNS tunneling detection and investigation
- Identifying beaconing behavior in network streams
- SSL/TLS decryption with session keys from memory
- NetFlow and IPFIX analysis for large-scale monitoring
- Geolocating C2 servers from packet captures
- Detecting lateral movement through SMB and RDP
- VoIP call reconstruction from RTP streams
- Identifying encrypted channels and covert protocols
- Timeline correlation: aligning netflow with host events
- Using Zeek (formerly Bro) for automated log generation
Module 12: Timeline Analysis and Correlation - Building comprehensive timelines: super-timelines
- Timeline sources: file system, registry, logs, memory
- Creating timelines with Plaso and log2timeline
- Setting up evidence collection for timeline building
- Filtering and parsing timeline data effectively
- Using timezones and leap seconds correctly
- Identifying time gaps and anomalies in activity
- Correlating events across multiple hosts
- Detecting timestomping through anomaly detection
- Exporting timelines for reporting and visualisation
- Integrating timeline data with SIEM outputs
- Linking user activity to system events
- Highlighting critical windows of compromise
- Using timelines in court presentations
- Automating timeline updates during ongoing investigations
Module 13: Forensic Tools Mastery: FTK, Autopsy, and X-Ways - FTK Imager: disk imaging and previewing evidence
- Creating and managing cases in FTK
- Indexing and keyword searching at scale
- Hash filtering: identifying known good and bad files
- Email parsing and thread reconstruction in FTK
- Generating comprehensive reports from FTK
- Autopsy interface and case management
- Keyword and regular expression searches in Autopsy
- Using Kali Linux with Autopsy for advanced analysis
- File carving with Autopsy and Scalpel
- X-Ways Forensics: navigating the interface
- Template-based analysis and automation in X-Ways
- Volume cloning and comparison techniques
- Advanced search and data carving with X-Ways
- Registry and file system analysis in X-Ways
- Cross-verification of findings across multiple tools
- Optimising tool performance for large datasets
Module 14: Mobile Device Forensics - Physical, logical, and file system extraction methods
- iOS backup analysis: iTunes and iCloud
- Extracting data from iOS system files and databases
- Location data analysis: GPS, Wi-Fi, cell towers
- Call and message history recovery from SQLite
- Android ADB extraction and root access methods
- Analysing app data: WhatsApp, Telegram, Signal
- Browsing history and search activity on mobile
- Cloud sync forensics: Google Drive, iCloud, Dropbox
- Mobile malware indicators and detection
- Lock screen bypass and encryption considerations
- Bluetooth and pairing history analysis
- Using Magnet AXIOM and Cellebrite (conceptual workflow)
- Reporting on mobile evidence in investigations
- Legal considerations in mobile seizures
Module 15: Cloud and Virtual Environment Forensics - Challenges of cloud forensics: data ownership and access
- Understanding shared responsibility models (AWS, Azure, GCP)
- Acquiring evidence from S3 buckets and blob storage
- CloudTrail, Azure Monitor, and Cloud Audit Logs analysis
- Identifying suspicious API calls and privilege escalation
- Virtual machine memory and disk acquisition
- Snapshot forensics in virtual environments
- Detecting VM escape and hypervisor compromise
- Container forensics: Docker and Kubernetes artifact recovery
- Serverless function logs and execution traces
- Logging and monitoring in hybrid cloud environments
- Incident response playbooks for cloud-native attacks
- Using native cloud tools for evidence collection
- Timeline alignment across distributed services
- Preserving chain of custody in cloud investigations
Module 16: Incident Response Playbook Development - Designing incident response playbooks for common scenarios
- Structure of a playbook: objectives, steps, tools, escalation
- Playbook for ransomware: detection, containment, recovery
- Insider threat playbook: data access, exfiltration, detection
- Phishing and credential compromise response workflow
- Malware outbreak: containment and eradication steps
- Privilege escalation and lateral movement playbook
- Cloud account compromise: MFA bypass, API misuse
- Incident declaration criteria and severity classification
- Roles and responsibilities during an incident
- Communication templates: internal, legal, public
- Integration with SOAR platforms and ticketing systems
- Testing playbooks through tabletop exercises
- Version control and update procedures for playbooks
- Organising playbooks by MITRE ATT&CK technique
Module 17: Reporting and Presenting Forensic Findings - Structure of a forensic report: executive summary, methodology, findings
- Writing for technical and non-technical audiences
- Visualising timelines and attack paths
- Using diagrams and flowcharts effectively
- Providing confidence levels for each finding
- Referencing raw evidence: file paths, hashes, timestamps
- Documenting assumptions and limitations
- Creating appendices: full logs, tool output, commands
- Defensible language and avoiding speculation
- Peer review and validation of reports
- Presenting findings to executives and legal teams
- Preparing for cross-examination and Q&A
- Using report templates for consistency
- Automating report generation with scripts
- Archiving reports for long-term retention
Module 18: GIAC Certification Preparation and Career Advancement - Overview of the GIAC certification process: GCFE, GCFA, GXPN
- Detailed breakdown of the GCFE exam objectives
- Recommended study path and time allocation
- Practice exam strategies and time management
- Commonly tested forensic scenarios on the GCFE
- Hands-on lab preparation and simulation exercises
- Sample questions and explanation of correct answers
- Understanding GIAC’s practical exam format
- Submitting the certification application
- Maintaining certification through CPEs
- Adding your certification to LinkedIn and resumes
- Benchmarking skills against industry standards
- Salary trends for GIAC certified professionals
- Transitioning into advanced roles: DFIR, threat hunting, IR lead
- Leveraging your Certificate of Completion from The Art of Service
- Building a professional portfolio of forensic reports
- Networking with other forensic analysts and mentors
- Accessing exclusive job boards and hiring partners
- Preparing for leadership in security investigations
- Introduction to network forensics and full packet capture
- TCP/IP fundamentals for forensic analysts
- Wireshark interface and display filtering
- Analyzing attack traffic: SYN floods, port scans, brute force
- Reconstructing HTTP sessions and file downloads
- Extracting images, documents, and credentials from captures
- DNS tunneling detection and investigation
- Identifying beaconing behavior in network streams
- SSL/TLS decryption with session keys from memory
- NetFlow and IPFIX analysis for large-scale monitoring
- Geolocating C2 servers from packet captures
- Detecting lateral movement through SMB and RDP
- VoIP call reconstruction from RTP streams
- Identifying encrypted channels and covert protocols
- Timeline correlation: aligning netflow with host events
- Using Zeek (formerly Bro) for automated log generation
Module 12: Timeline Analysis and Correlation - Building comprehensive timelines: super-timelines
- Timeline sources: file system, registry, logs, memory
- Creating timelines with Plaso and log2timeline
- Setting up evidence collection for timeline building
- Filtering and parsing timeline data effectively
- Using timezones and leap seconds correctly
- Identifying time gaps and anomalies in activity
- Correlating events across multiple hosts
- Detecting timestomping through anomaly detection
- Exporting timelines for reporting and visualisation
- Integrating timeline data with SIEM outputs
- Linking user activity to system events
- Highlighting critical windows of compromise
- Using timelines in court presentations
- Automating timeline updates during ongoing investigations
Module 13: Forensic Tools Mastery: FTK, Autopsy, and X-Ways - FTK Imager: disk imaging and previewing evidence
- Creating and managing cases in FTK
- Indexing and keyword searching at scale
- Hash filtering: identifying known good and bad files
- Email parsing and thread reconstruction in FTK
- Generating comprehensive reports from FTK
- Autopsy interface and case management
- Keyword and regular expression searches in Autopsy
- Using Kali Linux with Autopsy for advanced analysis
- File carving with Autopsy and Scalpel
- X-Ways Forensics: navigating the interface
- Template-based analysis and automation in X-Ways
- Volume cloning and comparison techniques
- Advanced search and data carving with X-Ways
- Registry and file system analysis in X-Ways
- Cross-verification of findings across multiple tools
- Optimising tool performance for large datasets
Module 14: Mobile Device Forensics - Physical, logical, and file system extraction methods
- iOS backup analysis: iTunes and iCloud
- Extracting data from iOS system files and databases
- Location data analysis: GPS, Wi-Fi, cell towers
- Call and message history recovery from SQLite
- Android ADB extraction and root access methods
- Analysing app data: WhatsApp, Telegram, Signal
- Browsing history and search activity on mobile
- Cloud sync forensics: Google Drive, iCloud, Dropbox
- Mobile malware indicators and detection
- Lock screen bypass and encryption considerations
- Bluetooth and pairing history analysis
- Using Magnet AXIOM and Cellebrite (conceptual workflow)
- Reporting on mobile evidence in investigations
- Legal considerations in mobile seizures
Module 15: Cloud and Virtual Environment Forensics - Challenges of cloud forensics: data ownership and access
- Understanding shared responsibility models (AWS, Azure, GCP)
- Acquiring evidence from S3 buckets and blob storage
- CloudTrail, Azure Monitor, and Cloud Audit Logs analysis
- Identifying suspicious API calls and privilege escalation
- Virtual machine memory and disk acquisition
- Snapshot forensics in virtual environments
- Detecting VM escape and hypervisor compromise
- Container forensics: Docker and Kubernetes artifact recovery
- Serverless function logs and execution traces
- Logging and monitoring in hybrid cloud environments
- Incident response playbooks for cloud-native attacks
- Using native cloud tools for evidence collection
- Timeline alignment across distributed services
- Preserving chain of custody in cloud investigations
Module 16: Incident Response Playbook Development - Designing incident response playbooks for common scenarios
- Structure of a playbook: objectives, steps, tools, escalation
- Playbook for ransomware: detection, containment, recovery
- Insider threat playbook: data access, exfiltration, detection
- Phishing and credential compromise response workflow
- Malware outbreak: containment and eradication steps
- Privilege escalation and lateral movement playbook
- Cloud account compromise: MFA bypass, API misuse
- Incident declaration criteria and severity classification
- Roles and responsibilities during an incident
- Communication templates: internal, legal, public
- Integration with SOAR platforms and ticketing systems
- Testing playbooks through tabletop exercises
- Version control and update procedures for playbooks
- Organising playbooks by MITRE ATT&CK technique
Module 17: Reporting and Presenting Forensic Findings - Structure of a forensic report: executive summary, methodology, findings
- Writing for technical and non-technical audiences
- Visualising timelines and attack paths
- Using diagrams and flowcharts effectively
- Providing confidence levels for each finding
- Referencing raw evidence: file paths, hashes, timestamps
- Documenting assumptions and limitations
- Creating appendices: full logs, tool output, commands
- Defensible language and avoiding speculation
- Peer review and validation of reports
- Presenting findings to executives and legal teams
- Preparing for cross-examination and Q&A
- Using report templates for consistency
- Automating report generation with scripts
- Archiving reports for long-term retention
Module 18: GIAC Certification Preparation and Career Advancement - Overview of the GIAC certification process: GCFE, GCFA, GXPN
- Detailed breakdown of the GCFE exam objectives
- Recommended study path and time allocation
- Practice exam strategies and time management
- Commonly tested forensic scenarios on the GCFE
- Hands-on lab preparation and simulation exercises
- Sample questions and explanation of correct answers
- Understanding GIAC’s practical exam format
- Submitting the certification application
- Maintaining certification through CPEs
- Adding your certification to LinkedIn and resumes
- Benchmarking skills against industry standards
- Salary trends for GIAC certified professionals
- Transitioning into advanced roles: DFIR, threat hunting, IR lead
- Leveraging your Certificate of Completion from The Art of Service
- Building a professional portfolio of forensic reports
- Networking with other forensic analysts and mentors
- Accessing exclusive job boards and hiring partners
- Preparing for leadership in security investigations
- FTK Imager: disk imaging and previewing evidence
- Creating and managing cases in FTK
- Indexing and keyword searching at scale
- Hash filtering: identifying known good and bad files
- Email parsing and thread reconstruction in FTK
- Generating comprehensive reports from FTK
- Autopsy interface and case management
- Keyword and regular expression searches in Autopsy
- Using Kali Linux with Autopsy for advanced analysis
- File carving with Autopsy and Scalpel
- X-Ways Forensics: navigating the interface
- Template-based analysis and automation in X-Ways
- Volume cloning and comparison techniques
- Advanced search and data carving with X-Ways
- Registry and file system analysis in X-Ways
- Cross-verification of findings across multiple tools
- Optimising tool performance for large datasets
Module 14: Mobile Device Forensics - Physical, logical, and file system extraction methods
- iOS backup analysis: iTunes and iCloud
- Extracting data from iOS system files and databases
- Location data analysis: GPS, Wi-Fi, cell towers
- Call and message history recovery from SQLite
- Android ADB extraction and root access methods
- Analysing app data: WhatsApp, Telegram, Signal
- Browsing history and search activity on mobile
- Cloud sync forensics: Google Drive, iCloud, Dropbox
- Mobile malware indicators and detection
- Lock screen bypass and encryption considerations
- Bluetooth and pairing history analysis
- Using Magnet AXIOM and Cellebrite (conceptual workflow)
- Reporting on mobile evidence in investigations
- Legal considerations in mobile seizures
Module 15: Cloud and Virtual Environment Forensics - Challenges of cloud forensics: data ownership and access
- Understanding shared responsibility models (AWS, Azure, GCP)
- Acquiring evidence from S3 buckets and blob storage
- CloudTrail, Azure Monitor, and Cloud Audit Logs analysis
- Identifying suspicious API calls and privilege escalation
- Virtual machine memory and disk acquisition
- Snapshot forensics in virtual environments
- Detecting VM escape and hypervisor compromise
- Container forensics: Docker and Kubernetes artifact recovery
- Serverless function logs and execution traces
- Logging and monitoring in hybrid cloud environments
- Incident response playbooks for cloud-native attacks
- Using native cloud tools for evidence collection
- Timeline alignment across distributed services
- Preserving chain of custody in cloud investigations
Module 16: Incident Response Playbook Development - Designing incident response playbooks for common scenarios
- Structure of a playbook: objectives, steps, tools, escalation
- Playbook for ransomware: detection, containment, recovery
- Insider threat playbook: data access, exfiltration, detection
- Phishing and credential compromise response workflow
- Malware outbreak: containment and eradication steps
- Privilege escalation and lateral movement playbook
- Cloud account compromise: MFA bypass, API misuse
- Incident declaration criteria and severity classification
- Roles and responsibilities during an incident
- Communication templates: internal, legal, public
- Integration with SOAR platforms and ticketing systems
- Testing playbooks through tabletop exercises
- Version control and update procedures for playbooks
- Organising playbooks by MITRE ATT&CK technique
Module 17: Reporting and Presenting Forensic Findings - Structure of a forensic report: executive summary, methodology, findings
- Writing for technical and non-technical audiences
- Visualising timelines and attack paths
- Using diagrams and flowcharts effectively
- Providing confidence levels for each finding
- Referencing raw evidence: file paths, hashes, timestamps
- Documenting assumptions and limitations
- Creating appendices: full logs, tool output, commands
- Defensible language and avoiding speculation
- Peer review and validation of reports
- Presenting findings to executives and legal teams
- Preparing for cross-examination and Q&A
- Using report templates for consistency
- Automating report generation with scripts
- Archiving reports for long-term retention
Module 18: GIAC Certification Preparation and Career Advancement - Overview of the GIAC certification process: GCFE, GCFA, GXPN
- Detailed breakdown of the GCFE exam objectives
- Recommended study path and time allocation
- Practice exam strategies and time management
- Commonly tested forensic scenarios on the GCFE
- Hands-on lab preparation and simulation exercises
- Sample questions and explanation of correct answers
- Understanding GIAC’s practical exam format
- Submitting the certification application
- Maintaining certification through CPEs
- Adding your certification to LinkedIn and resumes
- Benchmarking skills against industry standards
- Salary trends for GIAC certified professionals
- Transitioning into advanced roles: DFIR, threat hunting, IR lead
- Leveraging your Certificate of Completion from The Art of Service
- Building a professional portfolio of forensic reports
- Networking with other forensic analysts and mentors
- Accessing exclusive job boards and hiring partners
- Preparing for leadership in security investigations
- Challenges of cloud forensics: data ownership and access
- Understanding shared responsibility models (AWS, Azure, GCP)
- Acquiring evidence from S3 buckets and blob storage
- CloudTrail, Azure Monitor, and Cloud Audit Logs analysis
- Identifying suspicious API calls and privilege escalation
- Virtual machine memory and disk acquisition
- Snapshot forensics in virtual environments
- Detecting VM escape and hypervisor compromise
- Container forensics: Docker and Kubernetes artifact recovery
- Serverless function logs and execution traces
- Logging and monitoring in hybrid cloud environments
- Incident response playbooks for cloud-native attacks
- Using native cloud tools for evidence collection
- Timeline alignment across distributed services
- Preserving chain of custody in cloud investigations
Module 16: Incident Response Playbook Development - Designing incident response playbooks for common scenarios
- Structure of a playbook: objectives, steps, tools, escalation
- Playbook for ransomware: detection, containment, recovery
- Insider threat playbook: data access, exfiltration, detection
- Phishing and credential compromise response workflow
- Malware outbreak: containment and eradication steps
- Privilege escalation and lateral movement playbook
- Cloud account compromise: MFA bypass, API misuse
- Incident declaration criteria and severity classification
- Roles and responsibilities during an incident
- Communication templates: internal, legal, public
- Integration with SOAR platforms and ticketing systems
- Testing playbooks through tabletop exercises
- Version control and update procedures for playbooks
- Organising playbooks by MITRE ATT&CK technique
Module 17: Reporting and Presenting Forensic Findings - Structure of a forensic report: executive summary, methodology, findings
- Writing for technical and non-technical audiences
- Visualising timelines and attack paths
- Using diagrams and flowcharts effectively
- Providing confidence levels for each finding
- Referencing raw evidence: file paths, hashes, timestamps
- Documenting assumptions and limitations
- Creating appendices: full logs, tool output, commands
- Defensible language and avoiding speculation
- Peer review and validation of reports
- Presenting findings to executives and legal teams
- Preparing for cross-examination and Q&A
- Using report templates for consistency
- Automating report generation with scripts
- Archiving reports for long-term retention
Module 18: GIAC Certification Preparation and Career Advancement - Overview of the GIAC certification process: GCFE, GCFA, GXPN
- Detailed breakdown of the GCFE exam objectives
- Recommended study path and time allocation
- Practice exam strategies and time management
- Commonly tested forensic scenarios on the GCFE
- Hands-on lab preparation and simulation exercises
- Sample questions and explanation of correct answers
- Understanding GIAC’s practical exam format
- Submitting the certification application
- Maintaining certification through CPEs
- Adding your certification to LinkedIn and resumes
- Benchmarking skills against industry standards
- Salary trends for GIAC certified professionals
- Transitioning into advanced roles: DFIR, threat hunting, IR lead
- Leveraging your Certificate of Completion from The Art of Service
- Building a professional portfolio of forensic reports
- Networking with other forensic analysts and mentors
- Accessing exclusive job boards and hiring partners
- Preparing for leadership in security investigations
- Structure of a forensic report: executive summary, methodology, findings
- Writing for technical and non-technical audiences
- Visualising timelines and attack paths
- Using diagrams and flowcharts effectively
- Providing confidence levels for each finding
- Referencing raw evidence: file paths, hashes, timestamps
- Documenting assumptions and limitations
- Creating appendices: full logs, tool output, commands
- Defensible language and avoiding speculation
- Peer review and validation of reports
- Presenting findings to executives and legal teams
- Preparing for cross-examination and Q&A
- Using report templates for consistency
- Automating report generation with scripts
- Archiving reports for long-term retention