Investigate security incidents like a forensic examiner: evidence handling and chain of custody, disk and memory analysis, Windows and Linux artefacts, timelines, and court-ready reporting.
What you'll practise: Create and verify a forensic disk image with FTK Imager; Recover deleted files from a practice disk image with Autopsy; Analyse a memory dump for a hidden malicious process with Volatility; Trace user activity through Windows registry and event logs; Build a full incident timeline with Plaso and report your findings.