Forensics 45
- Lesson 11.3: Writing a standard forensics report
- Lesson 11.2: Investigating a malware infected image end to end
- Lesson 11.1: Solving CTF forensics challenges
- Lesson 10.2: Full Disk Encryption and Investigation Strategy
- Lesson 10.1: Timestomp, Wiping and Log Clearing Detection
- Lesson 9.3: IOCs and YARA for Bulk Artifact Scanning
- Lesson 9.2: Reconstructing the Attack Chain with MITRE ATT&CK
- Lesson 9.1: Super Timelines with plaso and Timesketch
- Lesson 8.3: Mobile forensics with Android and iOS backups
- Lesson 8.2: Email forensics and tracing the sender
- Lesson 8.1: Browser forensics and reconstructing web activity
- Lesson 7.3: Detecting C2, DNS tunneling, and exfiltration
- Lesson 7.2: Traffic analysis with Zeek and NetworkMiner
- Lesson 7.1: Reading pcap with Wireshark, filters, and object export
- Lesson 6.4: Extracting credentials and fileless PowerShell payloads from RAM
- Lesson 6.3: Detecting code injection, process hollowing, and rootkits in RAM
- Lesson 6.2: Processes, DLLs, network, and hidden processes
- Lesson 6.1: Memory forensics and Volatility 3 from scratch
- Lesson 5.2: macOS artifacts behind a suspicious auto-start app
- Lesson 5.1: Linux artifacts after an SSH brute force
- Lesson 4.6: Volume Shadow Copy and Recovering Old Files
- Lesson 4.5: Windows Persistence and Where Malware Hides
- Lesson 4.4: File and Folder Access Artifacts
- Lesson 4.3: Program Execution and Proving a Program Ran
- Lesson 4.2: Event Log Forensics with evtx Files
- Lesson 4.1: Registry Forensics and the Windows Hives
- Lesson 3.4: Analyzing hidden data
- Lesson 3.3: Recovering deleted files on NTFS and FAT
- Lesson 3.2: File carving when metadata is gone
- Lesson 3.1: The Sleuth Kit and Autopsy
- Lesson 2.4: Fast triage at the scene
- Lesson 2.3: Acquiring RAM on Windows and Linux
- Lesson 2.2: Creating a forensic disk image
- Lesson 2.1: Order of volatility, live and dead acquisition
- Lesson 1.7: Hashing and evidence integrity
- Lesson 1.6: ext4, APFS and HFS+ for forensics
- Lesson 1.5: NTFS and the MFT
- Lesson 1.4: FAT and exFAT file systems
- Lesson 1.3: MBR and GPT partition tables
- Lesson 1.2: Sectors, clusters, LBA and slack space
- Lesson 1.1: Hex, endianness and magic bytes
- Lesson 0.4: The Standard Investigation Process
- Lesson 0.3: Building a Forensics Lab
- Lesson 0.2: Law, Ethics and Chain of Custody
- Lesson 0.1: What Digital Forensics Is