Name & Affiliate Link*: Analyst I: Practical Windows Forensic Analyst (PWFA)

Platform: Blue Cape Security

Cost: $697

Payment Plan: Available at checkout via PayPal financing

Exam Type: Hands-On (2 attempts)

Certification Information: Includes Digital Certificate, Digital Badge, and a challenge coin for those scoring 85% or higher. The certification does not expire.

Training & Practice Included:

• 201 Practical Windows Forensics Course with Online Labs
  • Forensic Process & Forensic Reporting
  • Data Collection & Data Examination
  • Windows Registry & User Behavior Analysis
  • Event Log Analysis, Memory Analysis, & Super Timeline Creation
  • File System Analysis & Master File Table (MFT)
  • Timestomping, Deleted Files, Program Execution, & Persistence Mechanism
• FOR200: Investigation Scenarios
  • 4 lab-based forensic scenarios
  • Disk + memory images, case briefs, and investigation objectives
  • Preloaded lab VMs with forensic evidence
  • Scenario Solution Video Walkthroughs
  • Case Summaries and Timeline Analysis Reports
  • Certificates of Completion (Up to 12 CPE hours)
  • Incident Timeline (.xlsx)
  • PWF Report (.docx)
  • Analysis Notes (.docx)

*DFIR Diva is an affiliate of Blue Cape Security and receives a small percentage of sales made through affiliate links that go toward keeping the site running.

Name & Direct Link: Windows Forensics with Belkasoft

Platform: Belkasoft

Cost: $999

Hands-On: Yes

Proof of Completion: A certificate of achievement is provided to those who complete the training with a satisfactory score.

In this training, you will learn:

• How to review common Windows file systems, and which file system features might be useful in a DFIR investigation
• How to examine Windows applications, such as chats, browsers, and mail clients
• How to inspect media files and documents, and utilize media-specific analysis options, such as text recognition and keyframe extraction
• How to identify and analyze forensically important Windows system files, such as registry files, event logs, and LNK files
• How to get more evidence from a Windows data source by using carving, RAM analysis, and other advanced forensic techniques

Additional Information: Must use a professional or student email address for the training. If you do not already have a Belkasoft X Corporate license, you may request a trial version.

Name & Direct Link: Investigating Linux Devices

Certification Information: Certifications and Digital Badges

Platform: 13Cubed

Cost: $895

Exam Type: Hands-On/Multiple Choice

Topics Covered:

• Introduction to Linux
• Linux Logs
• Linux File Systems
• Persistence Mechanisms
• Evidence Collection
• Timelining
• Linux Memory Forensics
• Live Response
• Analyzing a Compromised System

Name & Direct Link: Network Forensic Fundamentals

Platform: YouTube

Topics:

• The PCAP File Format
• The Berkeley Packet Filter (BPF)
• tcpdump
• Wireshark
• Wireshark Options
• Wireshark Display Filters
• tshark
• Introduction to Simple Labs

Book Title: Placing the Suspect Behind the Keyboard: DFIR Investigative Mindset

Author: Brett Shavers

Book Website: Placing the Suspect Behind the Keyboard

Where to Buy:

Amazon*

Chapters Include:

• Technical Skills
  • Tech Prowess
• Knowledge
  • Rules of Civil/Criminal Procedure
  • Rules of Evidence
  • Evidence is not only just evidence
  • Does evidence prove or disprove theories?
• Self-Assessment
  • Who are you?
  • Curiosity
  • Your Identity
  • Other DFIR investigative traits
  • Your brain
  • Assessing your team
  • Self-assessment rating
• Senses
  • Perceptions & perspectives
  • Seeing & observing
  • Hearing & listening
• Hacking Your Mind
  • Critical thinking
  • Creative thinking
  • Visual thinking
  • Additional thinking models
  • Critical reading
  • Logic and reasoning
  • Cognition and ignorance
  • Theories and hypothesis
  • Think
  • Bias
  • Fallacies and reasoning errors
• Tactics
  • Old school & high tech
  • Checklists & procedures
  • The Investigative Cycle(s)
  • Live Cycles, Kill Chains, & Crime Scripting
  • Profiling
  • Identity
  • Link analysis
  • Notetaking
  • Problem-solving
  • Visualization to see the case
• Strategies
  • Micro and Macro
  • Decision-making
  • Focus and distractions
  • Correlation and causation
  • Targeting and pivoting
  • Errors and mistakes
  • Dumb ideas and terrible solutions
  • Words (and choice of words) matter
• Transformation
  • Scenario-based training
  • Visualization drills
  • Writing and speaking
  • Memory & documentation
  • Case studies
  • Unconscious competence?
  • Shadowing
  • Daily life of a critical thinker
  • Peer review
• Wisdom
  • Know yourself & seek self-improvement
  • Technical competence is your responsiblity
  • Hack your brain
  • Hack the adversary
  • Personal and professional accountability
  • Ethics and corruption
  • Credibility and reliability
  • Faults and competence
  • Pitfalls and self-made traps
• Education & Training
  • You need both training and education in DFIR
• AI as the Investigator
• Time to Liftoff
  • Obstacles to developing a DFIR Investigative Mindset
• Conclusion
  • My last bit of guidance for you

*As an Amazon Associate I earn from qualifying purchases. This helps with the cost of running this website.

Name & Direct Link: DFIR Labs

Platform: The DFIR Report

Cost: $14.99 – $29.99

Student Discount: Students get 30% off. Instructions can be found HERE.

Proof of Completion: Certificate and Badge upon completing the lab and quiz.

Description: Analyze logs related to published DFIR Reports.

Name & Direct Link: OpenText Encase Digital Forensics

Platform: YouTube

Cost: Free

Topics:

• How to Add Evidence Files
• Windows Registry | System and SAM Files
• How to Make a Keyword Search
• Evidence Processor

Name & Direct Link: Mastering Windows Forensics

Platform: Grzegorz Tworek

Cost: $299 – $799

Topics:

• Windows Search Artifacts
• NTFS Structures
• Disk Imaging
• Memory Dumps
• Windows Prefetch
• Hardware-Related Artifacts
• The Recycle Bin
• Log Analysis
• Windows Logging
• Internet Browser Artifacts
• SRUM Database
• Identifying Suspicious Files and Settings
• Active Directory and its Database
• Windows Registry Analysis
• User Profile Analysis
• Managing Digital Forensics and Incident Response
• Online and Offline Analysis
• Case Studies and Real-World Scenarios

Name & Direct Link: Android Forensics with Belkasoft

Platform: Belkasoft

Cost: $999

Hands-On: Yes

Proof of Completion: A certificate of achievement is provided to those who complete the training with a satisfactory score. Certificate recipients will get a discount on their next purchase from Belkasoft.

In this training, you will learn:

• How to use basic and advanced methods of Android acquisition, such as ADB-based and APK downgrade acquisition
• What chipset-specific acquisition methods can be used
• How to analyze Android apps, and what information can be extracted from them
• Which Android system files may be of interest for a DFIR investigation and how to analyze them

Additional Information: Must use a professional or student email address for the training. If you do not already have a Belkasoft X Corporate license, you may request a trial version.

Name & Direct Link: CNIT 121: Computer Forensics

Platform: Sam Bowne’s Website

Additional Information: This contains the class recordings and slides for the course taught at City College. Anyone can also attend any of the live class sessions on Twitch for free. Non-City College students can also take the quizzes. Visit Sam Bowne’s homepage to see if a live class is being taught: https://samsclass.info/

Topics: The Scope of Digital Forensics, Windows Operating and File Systems, Handling Computer Hardware, Acquiring Evidence in a Computer Forensics Lab, Online Investigations, Documenting the Investigation, Android Forensics, Admissibility of Digital Evidence, Network Forensics and Incident Response, Machine Learning, Mobile Forensics, Mac Forensics, Velociraptor