Digital Forensics & Incident Response
Carve deleted data, follow an attacker, and recover the truth from a machine.
- الوقت المتوقّع
- ساعتان
- الغرف
- 4 غرف
- النقاط
- 750 نقطة
- المسجّلون
- كن أول المسجّلين
عن هذا المسار
DFIR is the discipline of answering "what happened on this machine?" with evidence that holds up. This path deepens the defensive skillset: recovering data the owner believed was gone, reconstructing a full intrusion from logs and shell history, and reversing the tricks operators use to stage and hide their loot.
لمن هذا المسار
Defenders ready to go deeper than first-line triage — people who want to carve artefacts from raw media, work memory and process state, and produce a defensible reconstruction of an incident.
المتطلّبات المسبقة
The Blue Team path or equivalent experience: confident on a Linux shell, reading logs, and basic decoding. Familiarity with files on disk and process state helps.
ما الذي ستتمكّن من فعله
- Carve files and archives out of raw disk evidence
- Recover artefacts still held open by a running process
- Reconstruct an end-to-end intrusion from logs, history and persistence
- Reverse layered obfuscation (base64 over XOR) to read staged data
- Write up a clear, evidence-backed incident timeline
المنهج
الوحدة 1 — Disk & file recoveryاكتملت 0 من 1 غرف
The bytes outlive the directory entry.
الوحدة 2 — Live host & memoryاكتملت 0 من 1 غرف
What a process still holds when the file is gone.
الوحدة 3 — Full intrusion reconstructionاكتملت 0 من 2 غرف
From first failed login to staged exfil.