Purple Edge
Get started

DFIR — Forensics & Incident Response

intermediate4 labsSubscription

The incident-response lifecycle and digital forensics: triage, live endpoint forensics with Velociraptor, introductory memory analysis, and building a forensic timeline on a compromised host.

This path is available with a Purple Edge subscription. Sign in to read the full overview and start the labs.

Labs in this path

  1. 1
    intermediate Hands-on lab Subscription

    Incident Response Process & Triage

    Walk the NIST/PICERL incident-response lifecycle and perform first-responder triage of a compromised Windows host: where to look, what to collect, and how to spot a rogue process and persistence.

    35 min3 tasksDFIR
  2. 2
    intermediate Subscription

    Endpoint Forensics with Velociraptor

    Use Velociraptor and its VQL query language to hunt a live Windows endpoint at scale: surface persistence (autoruns, scheduled tasks), running processes, and network artifacts, and pull out the IOCs that confirm an intrusion.

    40 min4 tasksDFIR
  3. 3
    intermediate Subscription

    Memory Forensics Basics

    Acquire a memory image from a compromised Windows host and analyze it with Volatility 3: list processes, hunt for code injection with malfind, inspect network connections, and identify an injected process that disk artifacts never reveal.

    40 min3 tasksDFIR
  4. 4
    intermediate Hands-on lab Subscription

    Timeline & Artifact Analysis

    Build a forensic super-timeline from Windows artifacts (MFT, Prefetch, event logs, registry) with Plaso, then read it to reconstruct the full attack from initial access to objective and map each step to MITRE ATT&CK.

    40 min3 tasksDFIR

Unlock this lab

Launch the lab in your browser. Real Kali, Ubuntu and Windows targets, guided step by step. No setup, no VM downloads.

Create free accountSign in to start

Updated 2026-06-15