DFIR Resources #
I am quite often asked if there are sites, training, and/or books that I would recommend to get into DFIR and of course, continue to learn. So I have created a sub-page Resources with my recommendations. I will continue to update this page over time.
Last Updated: 6 November 2023
Podcast & Blogs #
|This Week in 4n6
|This Week in 4n6 is a collection of everything that happens on a weekly basis in the Digital Forensics and Incident Response community.
|Published weekly, the Risky Business podcast features news and in-depth commentary from security industry luminaries. Hosted by award-winning journalist Patrick Gray, Risky Business has become a must-listen digest for information security professionals.
|True stories from the dark side of the Internet. This is a podcast about hackers, breaches, shadow government activity, hacktivism, cybercrime, and all the things that dwell on the hidden parts of the network.
|Stark4n6 Forensics Startme Page
|One stop shop for DFIR resources and links, from tools, cheatsheets, hardware, blog feeds and more. Blog also has a load of CTF write ups.
|BlueMonkey 4n6 focuses on digital forensics and incident response using open-source tools. It covers various aspects of forensics on different platforms and tools.
|Forensics Reformatted Podcast
|Forensics Reformatted is a Digital Forensics podcast by former Chewing the FAT hosts, Adam Firman & Phil Cobley. The show is self-funded and aimed at supporting the DFIR community through insights, humour, and bringing together others from in and around the industry.
|ComfyCon AU was originally constructed as a conference in March 2020 as a response to the cancellation of Cyber Security conferences due to the COVID-19 pandemic.
|Digital Forensics Discord
|A Discord server ran by and for the DFIR Community!
Books & reading materials #
|Industrial Control Systems: Engineering Foundations and Cyber-Physical Attack Lifecycle
|This is a must read whitepaper by Dr. Marina Krotofil. This technical white paper serves as an introduction to cyber-physical security science and the art of cyber-physical attacks from an adversarial viewpoint. It aims to provide a comprehensive yet accessible overview of industrial control systems, their security needs, and cyber attacks. Chapter 4, which delves into the cyber-physical attack lifecycle, is a technical exploration of the attack surface of ICS. The paper provides insights into incidents like the Maroochy Shire sewage treatment and Los Angeles traffic control breaches, where malicious actors exploited radio-controlled systems.
|Digital Investigation Techniques: A NIST Scientific Foundation Review
|This document is an assessment of the scientific foundations of digital forensics. We examined descriptions of digital investigation techniques from peer-reviewed sources, academic and classroom materials, technical guidance from professional organizations, and independently published sources.
|Verizon’s Data Breach Investigations Report (DBIR) provides an annual analysis of security incidents and data breaches. The information and analysis are categorized by sector. Public sector organizations are key contributors to the report each year.
|Mandiant APT1 Report
|APT1 is one of dozens of threat groups Mandiant tracks around the world, and we consider it to be one of the most prolific in terms of the sheer quantity of information it has stolen.
Must have books #
|Digital Forensics with Open Source Tools
|Digital Forensics with Open Source Tools is the definitive book on investigating and analysing computer systems and media using open source tools. The book is a technical procedural guide, and explains the use of open source tools on Mac, Linux, and Windows systems as a platform for performing computer forensics.
|File System Forensic Analysis
|Most digital evidence is stored within the computer’s file system, but understanding how file systems work is one of the most technically challenging concepts for a digital investigator because there exists little documentation. Now, security expert Brian Carrier has written the definitive reference for everyone who wants to understand and be able to testify about how file system analysis is performed.
|The Art of Memory Forensics
|Memory forensics is the art of analyzing computer memory (RAM) to solve digital crimes. As a follow-up to the best seller Malware Analyst’s Cookbook, experts in the fields of malware, security, and digital forensics bring you a step-by-step guide to memory forensics―now the most sought after skill in the digital forensics and incident response fields.
Training courses #
|Free Short Course: Digital Forensics
|Cyber criminals saw their opportunity and made the most of it in 2020. With such a drastic shift to online everything for everyone, we saw cyber criminals make some pretty daring moves. Due to these increasingly sophisticated cyber-attacks, forensic investigations are becoming more and more common. This short course offers an introduction to our full Digital Forensics subject, including a high-level view of the emerging and evolving digital forensics field, investigating, detecting, and preventing digital crimes, formulating a digital forensics process, and more.
|Free Short Course: Cyber Warfare and Terrorism
|This four-week short course introduces you to the rise of state-sponsored cyber attacks, a concept that only a few years ago seemed within the realm of science fiction. You will be introduced to the major classes of cyber weapons: trojans, worms, and distributed denial of service, as well as sophisticated hacking. You will also learn the history of nation-state involvement in cyber attacks and the looming threat of cyber attacks from terrorist organizations.
|Free - DFIR Diva IR Training
|Elan, aka DFIR Diva, provides free incident response training for entry-level Incident Response Analysts who want to learn more about digital forensics and analysis on a limited budget.
|Free - Hal Pomeranz’s Linux Forensics Intro
|This course offers course materials and a lab virtual machine for an introductory course in Linux Forensics.
|Free - MITRE ATT&CK Training
|This training is designed to teach students how to apply the MITRE ATT&CK framework to help mitigate current threats. It covers the 12 core areas of the framework, helping students develop a thorough understanding of various attack vectors. Training is free and if you want to be certified you need to pay.
|Malware Unicorn’s Reverse Engineering 101
|This workshop provides the fundamentals of reversing engineering (RE) Windows malware using hands-on experience with RE tools and techniques. It covers RE terms, processes, basic x86 assembly programming, RE tools, and malware techniques.
|Splunk Fundamentals 1
|This course teaches you how to search and navigate in Splunk, use fields, get statistics from your data, create reports, dashboards, lookups, and alerts. It includes scenario-based examples and hands-on challenges.
|Binary Analysis Course
|This course provides a detailed explanation of each step taken when analyzing malware. It focuses on the thought process and technical analysis involved in the process.
|TryHackMe Cyber Security Training
|TryHackMe offers interactive lessons for hands-on learning. It includes network simulations and technology based on real-world examples.
|Become a Microsoft Sentinel Ninja: The complete level 400 training
|This training program includes 16 modules with presentations and supporting information for each module.
|Curated by Jai Minton, this page contains a variety of commands and concepts known through experience, education, tutorials, blogs, videos, professional training, and more.
|Google Technical Writing Course
|Learn the basics of technical writing through this course.
Blueteam training platforms #
I have not personally used any of these platforms, but am sharing the list, if you have any feedback on these feel free to let me know!
|Blue Team Labs Online
|This platform offers gamified challenges for defenders to practice security investigations in areas such as incident response, digital forensics, security operations, reverse engineering, and threat hunting. Free and paid tiers are available.
|CyberDefenders: Blue Team CTF Challenges
|This platform provides free access to gamified security challenges for defenders. It covers incident response, digital forensics, security operations, reverse engineering, and threat hunting.
|LetsDefend: Blue Team Training Platform
|Online SOC analyst and incident response training platform for blue team members.
Capture the flag archives #
|Capture The Flag Competitions (Archives)
|ACSC cyber security challenge
|The ACSC has released a simulated cyber incident challenge so anyone can test or improve their cyber response ability and forensic skills. Organisations may wish to use the challenge as a group training exercise for cyber security staff. The challenge was originally run at the BSides Canberra conference in April 2021.
|Metaspike Email Forensics CTF Competition
|Email forensics CTF challenges from 2021-2022 are available with solutions. Sign up to be notified when the next CTF challenge is run.
|MUS2019 DFIR CTF
|The DFIR CTF that was run at the Magnet User Summit in 2019 is now open to the public.
|About DFIR Challenge Links
|This site provides a much larger and more comprehensive list of DFIR CTF challenges and archives.