Every case hands you the parsed artifacts an examiner actually works from: MFT records, event logs, prefetch, registry hives, auth logs, process snapshots and network connections. You read the evidence, correlate it across sources, and commit to findings with a confidence grade, then a guided walkthrough shows what each artifact meant and how the pieces connected. For hands-on work with real tools, build your own forensic workstation and examine actual disk images and memory captures.
A departing engineer is suspected of exfiltrating proprietary data through a personal cloud storage account. Forensic image acquired from the workstation. Determine what data left, through which channels, over what time period.
A phishing email led to credential compromise, lateral movement, and ransomware deployment. Forensic image from the initial compromise workstation. Reconstruct the complete attack chain from initial access through encryption.
Unusual outbound connections detected from an internal web server. Live acquisition performed before isolation. Determine initial access, attacker actions, and lateral movement scope.
A Kubernetes web application pod executed unexpected host commands. Container runtime monitor detected escape from the webapp namespace. Determine the escape method, host compromise scope, and persistence mechanisms.
A departing project manager is suspected of copying sensitive bid documents to a personal USB drive. Forensic image acquired. Determine what removable storage was used, what data was copied, and whether the activity was deliberate.
Monitoring flagged sustained 98% CPU on a RHEL application server. A suspicious hidden process is consuming all resources with an active external network connection. Determine how access was gained and what the attacker installed.
SOC alert on anomalous PsExec activity on a file server. A service account executed commands it never runs. Trace the attack from initial phishing through credential theft and lateral movement to data staging.
A supplier is complaining about unpaid invoices, but Finance sent updated bank details last week, except the analyst says they never sent that email. Investigate the account compromise, inbox manipulation, and financial impact.
EDR flagged an anomalous scheduled task running a suspicious executable from AppData with periodic HTTPS beacons to an unrecognised domain. Determine the delivery method, persistence mechanisms, and C2 infrastructure.
Monitoring detected an unknown systemd service and a UID-0 user account on a database server. Trace the attack from contractor account compromise through SUID exploitation to rootkit installation.
SOC flagged anomalous DNS TXT queries from an HR workstation. No malware detected, the entire attack used only native Windows binaries. Trace the LOLBin chain from HTA phishing to DNS exfiltration.
Defender updates are failing on a file server. The HOSTS file has been tampered with, shadow copies are gone, and the Security log is empty. Work around six anti-forensic techniques to reconstruct the attack.
A disgruntled DBA on notice period dumped the production database and SCPed it to a personal VPS. Bash history was edited, but journald and auth logs tell the full story.
An unknown systemd timer appeared on a dev server after a routine npm install. A typosquatted package dropped a reverse shell payload via its postinstall hook. Trace the supply chain from package to persistence.
Two alerts fired minutes apart: anomalous RDP from an HR workstation to an admin jump box, then password SSH to a production database. Trace the three-host attack chain from phishing to credential theft to database exfiltration.
A CPU alert on a web server reveals a cryptominer, but the real threat is far worse. An admin VPN account was compromised, and the attacker spent 40 minutes across 6 systems: WMI, DCSync, golden ticket, SSH backdoors.