Resecurity® Certified Digital Forensics & Incident Response Professional (RCDFI)

About this course

Learn to investigate a security incident from first alert to final report. Over five days you will triage, plan acquisition, preserve evidence and examine endpoints, filesystems, memory, network traffic and logs to reconstruct exactly what an attacker did.

Forensic demonstrations and controlled labs lead into an integrated case that follows one enterprise incident through root cause, impact and remediation. You will practise defensible reporting and briefing, and the course prepares you for the RCDFI credential.

What you'll learn

• Triage an incident and decide which evidence to collect first.
• Plan acquisition and preserve digital evidence in a defensible way.
• Examine endpoint, filesystem and memory artefacts for signs of compromise.
• Analyse network, log and authentication evidence alongside host data.
• Build an evidence-based timeline of attacker activity.
• Identify persistence, lateral movement and likely data exfiltration.
• Determine root cause, control weaknesses and remediation priorities.
• Write forensic reports and brief technical and executive stakeholders.

Curriculum

Who it's for

Incident responders, DFIR and SOC analysts, forensic examiners and investigators who handle serious security incidents.

Before you start

• Familiarity with Windows and Linux, networking, security logs and basic incident response.
• Prior study or experience in security operations, response or system administration.

Prepares for