Purple Edge
Get started

DFIR: Forensics and Incident Response

intermediate6 labsSubscription

Investigate a compromise from the first alert to the final report: the response lifecycle, trustworthy evidence handling, live-response triage, memory and disk forensics, timelines, and a capstone where you reconstruct a new intrusion on your own.

This path is available with a Purple Edge subscription. Sign in to read the full overview and start the labs.

Labs in this path

  1. 1
    beginner Subscription

    DFIR Fundamentals: Events, Incidents and the Response Lifecycle

    What digital forensics and incident response are, how an event becomes an incident, and the six phases a team follows from the first alert to the lessons learned.

    35 min3 tasksfoundations
  2. 2
    beginner Subscription

    Handling Evidence: Volatility, Copies, Hashes and Custody

    The rules that make digital evidence trustworthy: collect the most fragile first, work on copies, prove nothing changed with a hash, record who held it, and write down everything you do.

    40 min3 tasksfoundations
  3. 3
    intermediate Hands-on lab Subscription

    Triage and Live Response

    Read the collection a responder took from a live, compromised workstation, check it has not changed, and find how the attacker made sure they would come back.

    50 min3 tasksfoundations
  4. 4
    intermediate Hands-on lab Subscription

    Memory Forensics: Find the Process That Does Not Belong

    Read the reports a memory-forensics tool produced from a compromised workstation and find the process the attacker took over, using its parent, its command line, injected code and its connections.

    55 min3 tasksfoundations
  5. 5
    intermediate Hands-on lab Subscription

    Disk and Timeline Forensics

    Read the timeline an analyst built from a compromised workstation's disk, narrow it to the minutes that matter, and find the file where the intrusion began.

    55 min3 tasksfoundations
  6. 6
    intermediate Hands-on lab Subscription

    Capstone: Reconstruct the Intrusion

    A new incident, a full evidence set, and one question: what happened? Verify the evidence, rebuild the story, prove each finding twice, recommend what to do, and capture the case flag.

    90 min3 tasksfoundations

Unlock this lab

Launch the lab in your browser. Real Kali, Ubuntu and Windows targets, guided step by step. No setup, no VM downloads.

Create free accountSign in to start

Updated 2026-11-01

We use cookies for analytics and advertising to improve Purple Edge and measure our campaigns. You can accept or decline non-essential cookies.