DFIR: Incident Response Practitioner

Digital forensics and incident response (DFIR) is the practice of answering two intertwined questions during a security incident: what happened (forensics), and what do we do about it (response). The two are inseparable in practice. A responder who contains a compromised host without preserving evidence loses the ability to answer 'how did they get in' or 'what did they take.' A forensic examiner who collects evidence without an eye toward containment can let an active intrusion continue unchecked while the analysis is underway. This course treats DFIR as one discipline, not two, and builds every module around that overlap.

NIST SP 800-61 defines four phases for incident handling: Preparation; Detection and Analysis; Containment, Eradication, and Recovery; and Post-Incident Activity. DFIR work happens throughout all four phases, not just in the middle. Preparation is where your toolkit, your evidence handling procedures, and your baseline knowledge of normal system behavior get built. Detection and Analysis is where the bulk of hands-on forensic work happens — memory captures, disk images, log correlation. Containment, Eradication, and Recovery draws on forensic findings to make decisions about what to isolate and what to rebuild. Post-Incident Activity is where the investigation gets written up and the lessons get fed back into detection and preparation.

• •Preparation — tooling, write-blockers, evidence handling procedures, and baseline system knowledge in place before an incident
• •Detection and Analysis — confirming an incident, scoping it, and performing the forensic work that answers what happened
• •Containment, Eradication, and Recovery — using forensic findings to isolate, remove the actor, and safely restore operations
• •Post-Incident Activity — root cause documentation, lessons learned, and process improvement

Every technique in this course is built around a single constraint: the act of investigating should change the evidence as little as possible, and every change that does happen should be documented. This is what 'forensically sound' means in practice. It's why acquisition tools hash before and after copying, why write-blockers exist, why analysts work from copies rather than originals, and why every command run against evidence during an investigation belongs in your notes, not just your memory. You don't need a courtroom to care about this. An internal investigation, a regulatory inquiry, or a second analyst reviewing your work six months later all benefit from the same discipline.

This isn't paranoia for its own sake — it's what makes findings survive scrutiny and lets someone else reproduce your conclusions from your notes alone.

You don't need an expensive commercial suite to do real DFIR work. The open-source tooling ecosystem covers acquisition, memory analysis, disk forensics, timeline generation, and log analysis end to end, and it's what most of this course is built around. A few categories to have ready before you need them, all covered in more depth in later modules.

• •Acquisition: dc3dd or dd for disk imaging, WinPmem or FTK Imager for memory capture
• •Memory analysis: Volatility 3
• •Disk and filesystem analysis: The Sleuth Kit / Autopsy, MFTECmd and other Eric Zimmerman tools for NTFS artifact parsing
• •Timeline generation: plaso / log2timeline
• •Log analysis: a SIEM if your environment has one, plus grep/awk and PowerShell for flat-file and Event Log work
• •Network forensics: Wireshark and tshark for packet capture analysis
• •A dedicated forensic workstation or VM, kept separate from production systems, with write-blocking hardware or software available for physical media

Each module below covers one stage of a DFIR investigation, roughly in the order you'd actually perform them: live triage, memory forensics, disk imaging and filesystem artifacts, log analysis, network forensics, malware triage, chain of custody, and reporting. The command examples throughout use real tool syntax — Volatility 3's actual plugin names, real dc3dd flags, real PowerShell and grep pipelines — so you can practice them against your own VMs, test images, or lab data. This is a self-paced, written course: there are no hosted labs or graded exercises built into it. The value comes from working through the commands yourself against material you set up, not from reading them passively.