Digital Forensics

Digital Forensics and Incident Response – Disgruntled on TryHackMe

Digital Forensics, Incident Response, TryHackMe /

The Disgruntled room places you in the role of a digital forensic investigator tasked with uncovering traces left behind by an unhappy employee. The challenge involves combing through Windows artifacts to identify suspicious activities, uncover deleted or hidden files, and piece together the motive behind the insider threat. By working step-by-step, you learn how forensic […]

Digital Forensics and Incident Response – Disgruntled on TryHackMe Read More »

Digital Forensics and Incident Response – Unattended on TryHackMe

Digital Forensics, Incident Response, TryHackMe /

In the Unattended room, I worked through a challenge-based investigation where I had to analyze forensic evidence and uncover what happened in a simulated incident. Unlike the guided rooms, this one tested my ability to put everything together on my own. It was a great way to validate the skills I had built up throughout

Digital Forensics and Incident Response – Unattended on TryHackMe Read More »

Digital Forensics and Incident Response – Intro to Malware Analysis on TryHackMe

Digital Forensics, Incident Response, TryHackMe /

This room provided an introduction to the process of malware analysis. I learned about static and dynamic analysis, and how to safely examine malware samples in a controlled environment. The focus was on understanding the behavior of malware and the clues it leaves behind. Completing this room gave me a better appreciation of the analyst’s

Digital Forensics and Incident Response – Intro to Malware Analysis on TryHackMe Read More »

Digital Forensics and Incident Response – TheHive Project on TryHackMe

Digital Forensics, Incident Response, TryHackMe /

In this room, I got hands-on with TheHive Project, an incident response platform designed to help teams manage investigations. I learned how to create and track cases, collaborate on findings, and connect alerts from multiple sources into a single workflow. TheHive reinforced the importance of organization and collaboration in DFIR. It showed me how analysts

Digital Forensics and Incident Response – TheHive Project on TryHackMe Read More »

Digital Forensics and Incident Response – Velociraptor on TryHackMe

Digital Forensics, Incident Response, TryHackMe /

This room introduced me to Velociraptor, an endpoint visibility and forensics tool that allows large-scale collection and monitoring. I learned how to query endpoints, collect forensic data, and investigate suspicious activity across multiple systems at once. Working with Velociraptor highlighted how powerful centralized forensics can be for enterprise environments. It showed me how this tool

Digital Forensics and Incident Response – Velociraptor on TryHackMe Read More »

Digital Forensics and Incident Response – Volatility on TryHackMe

Digital Forensics, Incident Response, TryHackMe /

In this room, I explored Volatility, another powerful memory forensics framework. I learned how to run plugins to extract detailed information from memory captures, such as processes, DLLs, network connections, and evidence of malicious activity. The exercises helped me understand the depth of insight memory forensics provides. Volatility made it clear that even volatile data

Digital Forensics and Incident Response – Volatility on TryHackMe Read More »

Digital Forensics and Incident Response – KAPE on TryHackMe

Digital Forensics, Incident Response, TryHackMe /

Here, I worked with Kroll Artifact Parser and Extractor (KAPE), a tool designed to quickly gather and parse forensic artifacts from endpoints. I learned how to configure it, collect targeted data, and use modules to analyze the results. KAPE showed me how automation can make forensic work faster and more focused. The room demonstrated how

Digital Forensics and Incident Response – KAPE on TryHackMe Read More »

Digital Forensics and Incident Response – Redline

Digital Forensics, TryHackMe /

This room focused on using Redline, a memory forensics tool, to analyze systems for signs of malicious activity. I learned how to collect memory snapshots and investigate them for artifacts like processes, network connections, and loaded modules. By practicing with Redline, I saw how memory analysis can uncover evidence that doesn’t persist on disk, such

Digital Forensics and Incident Response – Redline Read More »