Digital Forensics & Incident Response
Carve deleted data, follow an attacker, and recover the truth from a machine.
- Estimated time
- 2 hours
- Rooms
- 4 rooms
- Points
- 750 pts
- Enrolled
- Be the first to enroll
About this path
DFIR is the discipline of answering "what happened on this machine?" with evidence that holds up. This path deepens the defensive skillset: recovering data the owner believed was gone, reconstructing a full intrusion from logs and shell history, and reversing the tricks operators use to stage and hide their loot.
Who should start here
Defenders ready to go deeper than first-line triage — people who want to carve artefacts from raw media, work memory and process state, and produce a defensible reconstruction of an incident.
Prerequisites
The Blue Team path or equivalent experience: confident on a Linux shell, reading logs, and basic decoding. Familiarity with files on disk and process state helps.
What you will be able to do
- Carve files and archives out of raw disk evidence
- Recover artefacts still held open by a running process
- Reconstruct an end-to-end intrusion from logs, history and persistence
- Reverse layered obfuscation (base64 over XOR) to read staged data
- Write up a clear, evidence-backed incident timeline
Curriculum
Module 1 — Disk & file recovery0 of 1 rooms complete
The bytes outlive the directory entry.
Module 2 — Live host & memory0 of 1 rooms complete
What a process still holds when the file is gone.
Module 3 — Full intrusion reconstruction0 of 2 rooms complete
From first failed login to staged exfil.