EXPLORE THE CURRICULUM
Your learning map
See how it fits together. Find the lesson you want to learn next.
12 lessons · Forensics
Reset filtersL3Digital forensicsStep 239–25012 lessons
- 239 Hex and File Signatures: file, binwalk, Manual Carving — An Identity Check on Six BytesName the file type from the magic bytes of 10 major formats
- 240 Steganography: LSB, zsteg, Audio Spectrograms — The Letter Behind the Visible PictureExplain the principle of LSB embedding and hide and extract data yourself in Python
- 241 Advanced pcap Analysis: Wireshark Advanced Filters, tshark — Reconstructing an Incident from Ten Thousand PacketsDecide "where to dig first" with -z io,phs (protocol hierarchy) and -z conv,tcp (conversation list)
- 242 Memory Forensics: Volatility 3 — How to Catch Evidence That Vanishes When the Power Goes OffEnumerate the kinds of evidence that exist only in memory (processes, connections, command lines, cleartext da…
- 243 Disk Forensics: Autopsy, Deleted-File Recovery — What's Deleted Isn't GoneExplain structurally that filesystem deletion is "deallocation," not "data erasure"
- 244 Windows Forensics: Registry, Event Logs, Prefetch — Digging Through the Archive of Execution TracesExplain three kinds of Windows execution traces (Prefetch, UserAssist, event logs) using the term artifact
- 245 Log Analysis Scenario: Reconstructing an Intrusion Timeline — Scattered Puzzle Pieces into a Single Line of StoryRead one line of a web access log (Apache format) and an authentication log (auth.log format)
- 246 EXIF/Metadata and Document Forensics — Reading the Fingerprints Engraved Inside FilesExplain what EXIF and document metadata are and why they become evidence
- 247 Encrypted-Artifact Recovery Techniques — Three Keys That Open Locked EvidenceRecover a single-byte XOR-encrypted file with brute force (256 tries)
- 248 Five Comprehensive Forensics Challenges — Linking the Chain of Techniques on Your OwnPhysically perform the investigative order that starts with a signature check when handed an unknown file
- 249 Network Breach Analysis Simulation — Reconstructing the Incident Inside PacketsState the five phases of the IR process (preparation → detection → containment → recovery → lessons learned)
- 250 ★ Mid-Track Check: Solving a Comprehensive Forensics Challenge Independently + Report — Becoming Someone Who ProvesSelect and start a comprehensive forensics challenge without help