DFIR attribution; that is the key to DFIR.

The Windows Forensics course explores the forensic artifacts one may encounter when working with the Windows operating system. This course is focused on hands-on labs that covers artifacts, which are ...

From Shells to Thrones - Think Like an Adversary. Hunt as a Defender. Protect the Kingdom.

Use the discount code thisweekin4n6 for 15% off any class at Cyber5w.Use the code PM15 or click this link for 15% your next Hexordia classTakes a class with me! Akash Patel Who’s Using a Proxy or V…

The CDFF exam validates your understanding of digital forensics fundamentals, including evidence acquisition, file systems, FTK Imager, timestamp analysis, and reporting, ideal for beginners entering ...

The Windows Forensics course explores the forensic artifacts one may encounter when working with the Windows operating system. This course is focused on hands-on labs that covers artifacts, which are ...

TL;DR A lot of bloat in an EXE file is just the statically linked C runtime. Link dynamically to msvcrt.dll (or ucrtbase.dll on Win 10+) plus a 40-line stub, and depending on the size of the progra…

In this micro-course, you will learn how to install and configure Windows Sandbox to be used for different testing scenarios, such as malware analysis. By the end of this course, you will have a fully...

Working with 010 Editor: A Practical Guide to Binary Analysis

YouTube video by Ali Hadi

In this webinar, IoT forensics expert Tom Claflin explored the role of IoT devices in modern investigations, demonstrating data extraction techniques, device disassembly, and key forensic tools. He al...

Digital Forensics Courses and Training

Process Hollowing (a.k.a. RunPE) is probably the oldest, and the most popular process impersonation technique (it allows to run a malicious executable under the cover of a benign process). It is us…