Purple Edge
Get started

DFIR: Forensics and Incident Response

intermediate5 labsSubscription

Investigate a compromise end to end: IR fundamentals, live-response triage, memory and disk forensics, timeline analysis, and a full intrusion-reconstruction capstone.

This path is available with a Purple Edge subscription. Sign in to read the full overview and start the labs.

Labs in this path

  1. 1
    beginner Hands-on lab Subscription

    DFIR Fundamentals

    The incident-response process and the order of volatility that decides what you collect first.

    35 min3 tasksblue-team
  2. 2
    intermediate Hands-on lab Subscription

    Triage and Live Response

    Collect volatile evidence from a live host without trampling the scene.

    45 min3 tasksblue-team
  3. 3
    advanced Hands-on lab Subscription

    Memory Forensics

    Analyse a memory image to find hidden processes, injected code, and network activity that disk cannot show.

    55 min3 tasksblue-team
  4. 4
    advanced Hands-on lab Subscription

    Disk and Timeline Forensics

    Recover artifacts from a disk image and build a super-timeline that orders the attacker's actions.

    55 min3 tasksblue-team
  5. 5
    advanced Hands-on lab Subscription

    Capstone: Reconstruct the Intrusion

    Given a compromised host, run the full DFIR process to reconstruct the attack and produce the key findings.

    90 min3 tasksblue-team

Unlock this lab

Launch the lab in your browser. Real Kali, Ubuntu and Windows targets, guided step by step. No setup, no VM downloads.

Create free accountSign in to start

Updated 2026-09-01