Digital Forensics and Incident Response
A detailed DFIR program for corporate incident responders and forensic investigators who need to collect evidence, analyze artifacts, correlate incident activity, and report defensible findings.
Digital Forensics and Incident Response training.
Digital Forensics and Incident Response focuses on enterprise forensics, incident correlation, evidence collection, threat hunting, and APT investigation workflow. The course helps learners understand why corporate forensics differs from criminal investigation and how deep forensic analysis supports incident response.
Enterprise forensics, incident response, triage, evidence handling, artifact analysis, threat hunting, and defensible reporting.
The page gives learners a concise executive overview first, then separates detailed coverage and expected outcomes for easier course evaluation.
What the course focuses on.
Each area is presented as part of a practical security workflow, with emphasis on evidence, validation, and professional communication.
Enterprise DFIR
Corporate investigation goals, forensic correlation with incident response, and why APT hunting requires deep analysis.
Triage and Collection
Forensics triage, evidence collection, event analysis, and preparation for defensible investigation workflow.
Artifact Analysis
Document metadata, file metadata, removable media, browser artifacts, email investigation, and file carving.
Attack Timeline Review
Initial access, lateral movement, persistence, and event correlation across a breached environment.
Threat Hunting
MITRE ATT&CK mapping, investigation case complexity, threat-intelligence context, and APT case methodology.
Reporting
Evidence-backed findings, timeline communication, remediation support, and incident-response documentation.
Training modules.
The syllabus below follows the original Codefensive public course outline for this training.
Digital Forensics and Incident Response Fundamentals
- What is corporate digital forensics
- why corporate digital forensics is different from criminal investigations
- The forensics correlation with incident response
- why we need deep forensics in APT hunting
- Understating the APT and attacks
- What is MITRE & AT framework for investigations
- Basic Forensic Process
- Forensics 6A’s
- Physical Protection of Evidence
- Chain of custody
- Forensic Investigator roles
- Investigation Methods in breached environments
- Understanding the complexity of investigation case
- Enterprise Training Case – A detailed threat hunting , threat intelligence and IR team investigation case
Data Triage and Event Log Analysis
- Windows operation systems anatomy for forensics point of view
- NTFS file system overview
- Documents and File metadata understanding
- File and stream carving tools and techniques
- Web browsers private search Artifact recovery and examination
- Email artifacts recovery and examination
- Application Execution History via UserAssist, Prefetch, Windows Timeline
- System Resource Usage Monitor (SRUM), and BAM/DAM
- Detecting the System hacking events with prefetch , shimcache
- Live memory forensics vs Dead forensics
- Identify the insecurities in machine with amcache
- Windows Log Parsing and environment setup
- Windows multiple Events correlation for forensics in depth
Windows System Analysis for Incident Response
- System Analysis
- Identify the Current Control Sets
- Document the System Timezone , name and version
- Wireless, Wired, VPN, and Broadband Network Auditing
- Perform Device Geolocation via Network Profiling
- Identify System Updates and Last Shutdown Time
- Registry-Based Malware Persistence methods
- Additional Windows OS Artifacts
- Windows Search Index Forensics
- Extensible Storage Engine Database Recovery and Repair
- Thumbs.db and Thumbcache Files
- Windows Recycle Bin Analysis
- Windows Timeline Activities Database
- Evidence of File Downloads
- Office and Microsoft 365 File History Analysis
- Windows Search History changes
- Typed Paths and Directories
- Recent Documents (RecentDocs)
- Open Save/Run Dialog Boxes Evidence
- Shellbag Forensics
- Shortcut Files (.lnk) – Evidence of File Opening
- Windows 7-11 Jumplists – Evidence of File Opening and Program Execution
- Shellbag – Evidence of Folder Access
Windows Registries and Removable media Investigations
- Registry Core
- Hives, Keys, and Values
- Registry Last Write Time
- MRU Lists
- Deleted Registry Key Recovery
- Identify Dirty Registry Hives and Recover Missing Data
- Rapidly Time-lining Multiple Hive
Investigating Memory for Anomaly Detection
- Windows process architecture for memory mapping
- memory analysis vs volume shadow copies detections
- KDBG ,VAD tree , PEB and EPRROCESS in depth for memory analysis
- Memory blocks and hibernation internconnection analysis
- Importance of Cache Data in memoery analysis
- Evidence mapping in Memory with APT detection techniques
- Analysing memory for rootkits and dll hijacking ,hollowing investigations
- Windows process injections anatomy and investigations
- In-depth APT malware attacks investigations
- Python for modern memory investigations
- Anti-forensics techniques and evidence for investigations
- Forensics timeline science and super-timelining for anti-forensics techniques
Browser Forensics
- History and Cache
- Searches and Downloads
- Understanding Browser Timestamps
- Private Browsing and Artifact Recovery
- IE and EdgeHTML InPrivate Browsing analysis
- Private Browsing analysis
- Investigating the Tor Browser
- SQLite and ESE Database Carving and additional Browser Artifacts
- Identifying Selective Database Deletion
- DOM and Web Storage Objects analysis
- Rebuilding Cached Web Pages
Email Investigations
- Evidence of User Communication
- Email Header Examination
- Email Authenticity
- Determining a Geographic Location
- Extended MAPI Headers
- Host-Based Email Forensics
- Exchange Recoverable Items
- Exchange Evidence Acquisition and Mail
- Exchange Search and eDiscovery
- Unified Audit Logs in Office 365
- Google Workspace (G Suite) Logging
- Recovering Data from the G Suite
- Webmail Acquisition
- Business Email Compromise analys
Removable Media and BYOD Investigations
- Removable Media Vendor/Make/Version
- Unique Serial Number identification
- Last Drive Letter
- MountPoints2 -Last Drive Mapping Per User (Including Mapped Shares)
- Volume Name and Serial Number
- The username that Used the USB Device
- Time of First USB Device Connection
- Time of Last USB Device Connection
- Time of Last USB Device Removal
- Auditing BYOD Devices at Scale
- Investigating wiped evidences of USB mount points
APT Incident Response Primer
- Understanding the attacks and techniques for privilege escalation
- Identify events of privilege escalation
- PowerShell for forensics and live detection of active directory attacks
- Network forensics and evidence detection in corporate networks
- Extract files from network packet capture and proxy cache files, allowing follow-on malware analysis or definitive data loss determinations
- Use historical NetFlow data to identify relevant past network occurrences, allowing accurate incident scoping
- Reverse engineer custom network protocols to identify an attacker’s command-and-control abilities and actions
- Examine traffic using common network protocols to identify patterns of activity or specific actions that warrant further investigation
- Incorporate log data into a comprehensive analytic process, filling knowledge gaps that may be far in the past
- Prepare an report for Incident Response Anatomy and Detection .
After this course, learners should be able to:
- Collect and preserve evidence for enterprise investigations.
- Correlate forensic artifacts with incident-response activity.
- Analyze endpoint, file, browser, email, and timeline evidence.
- Prepare clear investigation reports with defensible conclusions.
Best suited for:
- incident responders
- digital forensic analysts
- SOC and threat hunting teams
- security professionals responsible for investigation and evidence handling
Built for professional learning.
Training is structured around readable theory, guided walkthrough context, exercises, knowledge checks, and practical decision-making.
Plan enrollment or team delivery.
Contact Codefensive Academy for course access, business training, or help selecting the right path.
Structured DFIR training focused on evidence handling, triage, artifact analysis, incident validation, and defensible reporting.
