Name & Affiliate Link*: Analyst I: Practical Windows Forensic Analyst (PWFA)

Platform: Blue Cape Security

Cost: $697

Payment Plan: Available at checkout via PayPal financing

Exam Type: Hands-On (2 attempts)

Certification Information: Includes Digital Certificate, Digital Badge, and a challenge coin for those scoring 85% or higher. The certification does not expire.

Training & Practice Included:

• 201 Practical Windows Forensics Course with Online Labs
  • Forensic Process & Forensic Reporting
  • Data Collection & Data Examination
  • Windows Registry & User Behavior Analysis
  • Event Log Analysis, Memory Analysis, & Super Timeline Creation
  • File System Analysis & Master File Table (MFT)
  • Timestomping, Deleted Files, Program Execution, & Persistence Mechanism
• FOR200: Investigation Scenarios
  • 4 lab-based forensic scenarios
  • Disk + memory images, case briefs, and investigation objectives
  • Preloaded lab VMs with forensic evidence
  • Scenario Solution Video Walkthroughs
  • Case Summaries and Timeline Analysis Reports
  • Certificates of Completion (Up to 12 CPE hours)
  • Incident Timeline (.xlsx)
  • PWF Report (.docx)
  • Analysis Notes (.docx)

*DFIR Diva is an affiliate of Blue Cape Security and receives a small percentage of sales made through affiliate links that go toward keeping the site running.

Name & Direct Link: C5W Investigating Linux Systems

Platform: Cyber 5W

Training & Exam Pricing: $650

Exam Type: Practical Hands-On

Student Discount: Students get 25% off when registering with their college or university email account and contacting Cyber 5W

Topics: Introduction to Linux, Essential Tools and Techniques, System Analysis, File Systems and Log Analysis, GUI & USB Forensics, Writing Forensic Reports

Name & Direct Link: Security Analyst Level 1 (SAL1)

Platform: TryHackMe

Training & Exam Pricing: $349 (includes training and exam)

Exam Type: Multiple Choice and Hands-On

Topics: Computing Foundations, Cyber Defense Frameworks, Common Malicious Behavior (phishing, network attacks, exploitation, authentication attacks, malware, LOLBAS attacks), Tools of the Trade (EDR, WAF, NDR, SIEM, SOAR, TIP), Incident Response (IR) Plan, Playbooks, Network Architecture Diagrams, Alert Triage and Ticketing, SOC Metrics and KPIs.

Community: There is a TryHackMe Discord Server

Name & Affiliate Link*: Practical SOC Analyst Associate (PSAA)

Platform: TCM Security

Price: $249 (includes training and exam voucher that doesn’t expire)

Student Discount: Students, Veterans, Teachers and First Responders can get a 20% discount.

Exam Type: Practical Hands-On

Topics:

• Security Operations Fundamentals
• Phishing Analysis
• Network Security Monitoring
• Network Traffic Analysis
• Endpoint Security Monitoring
• Endpoint Detection and Response
• Log Analysis and Management
• Security Information and Event Management (SIEM)
• Threat Intelligence
• Digital Forensics
• Incident Response

*DFIR Diva is an affiliate of TCM Security and receives a small percentage of sales made through affiliate links that go toward keeping the site running.

Name & Direct Link: MCDFA – Certified Cyber Defense Forensics Analyst

Platform: Mossé Cyber Security Institute

Community: They have a Discord Server

Training & Certification Pricing: $995

Topics:

• Lab Setup
• File Analysis
• Disk and Filesystem Forensics
• Executable Analysis
• Windows Forensics
• Windows 10 Forensics
• Behavioral Analysis
• Memory Forensics
• Malware Analysis
• Memory Forensics Challenges
• Network Forensics Challenges
• Documentation
• Business Email Compromise Investigation Scenario
• Ransomware Investigation Scenario
• Android Mobile Forensics Investigation Scenario

Additional Information: This isn’t a typical approach to a certification. You complete practical scenarios to earn the certification.

Name & Direct Link: Investigating Linux Devices

Certification Information: Certifications and Digital Badges

Platform: 13Cubed

Cost: $895

Exam Type: Hands-On/Multiple Choice

Topics Covered:

• Introduction to Linux
• Linux Logs
• Linux File Systems
• Persistence Mechanisms
• Evidence Collection
• Timelining
• Linux Memory Forensics
• Live Response
• Analyzing a Compromised System

Name & Direct Link: C5W Certified Malware Analyst (CCMA) – On Demand

Platform: Cyber 5W

Cost: $650

Topics:

• Introduction to Malware Analysis
• Static Malware Analysis 101
• Dynamic Malware Analysis 101
• Static Malware Analysis 102 – IDA Pro
• Static Malware Analysis 102 – Ghidra
• Dynamic Malware Analysis 102
• Analyzing Managed Code (readable/uncompiled)
• Extracting IOCs and Writing YARA Rules
• Hands-On Labs

Name & Direct Link: Paraben E3 Mobile Operator Online On Demand Course & DSMO Certification

Platform: Paraben Corporation

Cost: $299

Proof of Completion: Certification

Student Discount: There is a student program for actively enrolled college students or military transferring from service to career jobs.

Topics: E3 Software Installation, Licensing, E3 Interface, Adding Evidence, Acquiring Phones, Acquiring a Feature Phone, Acquiring iOS, Acquiring Android, Importing Backups, Reviewing Data, App Analysis, SQLite Analysis, Content Analysis, Importing Cloud Data, Searching & Sorting Data, Generating Reports

Name & Direct Link: Paraben Online On Demand Computer Training and Certification

Platform: Paraben Corporation

Cost: $299 – $595

Proof of Completion: Certification

Student Discount: There is a student package for actively enrolled college students or military transferring from service to career jobs.

Computer Operator Course & P2CO Certification

Topics: Paraben E3 Software Installation, Licensing, E3 Interface, Adding Evidence, Physical Drive, Hard Drive Image, Email Archive, Internet Browser Data, Drive Triage, Registry, Content Analysis, Forensic Containers Overview, Searching and Sorting Data, Generating Reports

Name & Direct Link: Investigating Windows Memory

Certification Information: Certifications and Digital Badges

Platform: 13Cubed

Cost: $795

Exam Type: Hands-On/Multiple Choice

Topics Covered:

• Windows Memory Structures
• Windows Process Genealogy
• Acquiring Memory
• Best Practices for Virtual Machines
• VMWare ESXi
• Microsoft Hyper-V
• Strings and Bstrings
• Pagefile.sys and Swapfile.sys
• Memory Analysis with Volatility
• Process Enumeration
• Network Activity
• Registry Analysis
• Process Hollowing
• Dumping Files
• YARA Scans
• Strings
• Volatility Shell (volshell)
• Malware Memory Analysis with Volatility
• Memory Analysis with MemProcFS
• Malware Memory Analysis with MemProcFS
• Introduction to WinDbg
• Hibernation Files