Image a live system
Acquire a write-blocked drive and capture memory from a running host, verifying every hash as you go — with each step logged and every container labelled.
Training · DFIR · Practitioner programme
Pull the disk. Capture the memory. Write the report a regulator will read.
An evidence-first DFIR programme built on real engagement telemetry. Six forensic specialisms — host, memory, network, malware RE, cloud, ICS/OT — taught in the order an incident demands them. Chain of custody as a drilled habit, not a memorised slide.
The training gap
Most DFIR courses teach you the tools. They don't teach you the discipline.
Anyone can run Volatility against a memory capture. Few can decide, under time pressure, which capture to take, in which order, before which containment action — and then write the result in a form that survives a regulator review and a court submission. Learning the tools is a week's work; building that judgement is what the other thirteen are for.
01
Tool-led, not lifecycle-led
A course on "memory forensics" teaches you to use Volatility. It does not teach you when memory matters more than disk, or when you have already lost it.
02
Chain of custody as theory
Every textbook explains chain of custody. Few programmes drill it. The habit is built one preservation exercise at a time, with the seal numbers checked and the timestamps audited.
03
Specialisms left out
Cloud forensics and ICS/OT forensics are the specialisms that real incidents demand and most curricula quietly skip. We don't.
Six specialisms
The specialisms a complete DFIR practitioner can switch between mid-incident.
Each specialism is a 2- to 3-week module. The full programme covers all six in sequence, paced to how an actual incident unfolds — preservation primitives first, deep technical analysis later, cloud and OT specialisms layered over the foundation.
What you do on the programme
Six modules. Six exhibits. One incident-report portfolio you can show at interview.
Reconstruct the timeline
Build filesystem timelines (MFT, USN, $LogFile), registry timelines (UserAssist, ShellBags), and process-execution timelines (Prefetch, ShimCache, AmCache), then cross-reference them until the gap shows itself.
Analyse a live capture
Run Volatility against a memory image to find the hidden process, the injected DLL and the in-memory loader the EDR missed — then recover credentials the attacker assumed were long gone.
Take apart a malware sample
Do static triage with a hex editor and disassembler, then dynamic analysis in an isolated sandbox — pull out the config and C2 signatures, and hand off the IOCs as if a live IR team were waiting on them.
Work a cloud trail
Reconstruct CloudTrail events, trace IAM-policy abuse paths, and spot OAuth-app over-permissioning — the fastest-changing forensic discipline, and the one you have to handle from day one.
Write the four reports
A technical narrative for IR peers, an executive summary for the board, a regulator-grade timeline, and a counsel-grade evidence catalogue — the same facts, written four ways for four readers.
Sample week · Memory forensics · week 4 of 14
The week you stop trusting the EDR alone.
A representative memory-forensics week — the discipline that recovers what disk forensics cannot. By Friday, every cohort member can land on a captured image and tell you what was alive in RAM at the moment of acquisition.
Monday
Capture techniques
Live RAM acquisition on Windows, Linux and macOS, plus hibernation files, pagefile/swap recovery, and hypervisor-assisted capture for VMs — verifying integrity hashes against the live system at every step.
Tuesday
Process trees and parent-child anomalies
Walk a real captured image and pick out the tells: the unsigned binary spawned by Word, the PowerShell child of a non-shell parent, the svchost with the wrong command line — then defend each finding out loud.
Wednesday
Code injection — the four techniques you must recognise
Classic DLL injection, reflective loading, process hollowing, module overwriting — each technique leaves its own memory signature, each signature has a Volatility plugin, and your job is to match one to the other.
Thursday
Credentials in memory
LSASS structure analysis, NTLM and Kerberos secret recovery, and the wreckage a single credential dump leaves behind in memory — then the hard call: when do you tell the customer their domain is compromised, and who hears it first?
Friday morning
Timed capture exercise
You get a fresh, unbriefed memory image and ninety minutes to find the persistence mechanism, the C2 channel and the injected payload — then write a one-page technical summary and hand it in.
Friday afternoon
Cohort debrief
Every cohort member presents their capstone findings. The instructor compares against ground truth. The misses are graded harder than the hits — what did you not see, and why didn't you look?
Tooling coverage
The open-source DFIR toolchain, learned to the point of muscle memory.
Acquisition
dd, FTK Imager (CLI), Linux LiME, AVML, hypervisor memory dumping, write-blocker discipline.
Disk + file system
TSK / Autopsy, plaso / log2timeline, MFTECmd, RECmd, ShellBags Explorer, USN parsers.
Memory
Volatility 3, Rekall and MemProcFS — plus authoring your own plugins for the cases your incident demands and Volatility doesn't ship.
Network
Wireshark, tshark, Zeek scripting, Suricata rule authoring, NetFlow analysis, and PCAP triage on captures too large to open by hand.
Malware RE
Ghidra, x64dbg, radare2, IDA Free, YARA authoring, sandboxing in isolated containers.
Cloud control plane
CloudTrail / CloudWatch parsers, Azure Activity Log analysers, GCP audit-log queries, cloud-snapshot evidence acquisition.
OT artefacts
PLC firmware extractors, HMI log parsers, engineering-station registry investigations, Modbus / OPC-UA capture analysis.
Reporting + evidence
Chain-of-custody templates, hash-manifest generation, audit-grade case management, four-audience report assembly.
What you walk away with
A practitioner you can put on the next breach.
Incident-report portfolio
Six full incident write-ups, one per specialism, each rewritten for the four readers an investigation answers to — IR peers, the board, the regulator, and counsel.
Capstone certification
A 24-hour capstone incident in week 14. Pass it to certify — the rubric is the same one used to grade live engagements.
Court / regulator readiness
Chain-of-custody habit drilled every week. By exit, you have produced evidence packs that will hold up to scrutiny.
Hiring pipeline access
The Cyberange consulting team, sovereign and BFSI SOCs, and regulator forensic units — reached through a referral, not a job portal.
Mapped to
- CERT-In Directions · 6-hr window
- NCIIPC CII evidence handling
- NIST SP 800-86
- NIST SP 800-61 r2
- ISO/IEC 27037 · 27042
- ENISA digital evidence
- RFC 3227
Practice
"Chain of custody is a habit, not a fact you memorise. You build it drill by drill — sealing, hashing, logging — until it holds up on the one incident where there is no second chance at hour zero."
Fourteen weeks. Six specialisms. One portfolio.
Weekend and weekday cohorts. Corporate cohorts on request. Single-specialism modules available standalone for working DFIR practitioners.