Advanced Digital Forensics and Malware Analysis Training Course

Course overview

Security teams need investigators who can move beyond collecting files and alerts to reconstructing an intrusion, establish what executed, identify persistence, determine scope, and preserve findings that can withstand technical and management scrutiny. This course addresses the point at which a suspected endpoint compromise, malicious attachment, ransomware event, or insider activity investigation requires defensible evidence handling and disciplined malware triage. Participants learn to distinguish artefact-based facts from assumptions, reduce false leads, and communicate impact clearly enough to support containment, recovery, legal, and executive decisions.

Across five days, participants examine Windows file-system, registry, event-log, browser, execution, and persistence artefacts; acquire and analyse volatile memory; inspect packet captures; and perform safe static and behavioural malware analysis. They use Autopsy for disk examination, Volatility 3 for memory analysis, Wireshark for network evidence, and Ghidra for reverse engineering selected malicious binaries. The course covers hashing, chain of custody, timeline creation, IOC extraction, YARA-rule concepts, malware configuration discovery, anti-analysis indicators, and structured incident reporting.

Teaching combines expert-led demonstrations with guided forensic labs built around a realistic compromise scenario. Each participant works through evidence sets containing disk images, memory captures, PCAP files, email artefacts, and suspicious executables in an isolated analysis environment. By the end of the week, participants produce an investigation case file: an evidence log, timeline of attacker activity, malware triage record, IOC set, prioritised containment recommendations, and an executive-ready technical report. This is a practical deliverable that can be adapted into an organisation's own incident-response and forensic workflow.

The course is designed for practitioners who already understand core cyber security operations and now need deeper capability in host forensics, malware investigation, and evidence-led incident handling.

Course objectives

By the end of this course, participants will be able to:

• Acquire and document disk and memory evidence using hashes, evidence logs, and chain-of-custody records
• Reconstruct attacker activity through Windows artefact analysis and super-timeline creation
• Identify persistence mechanisms from registry, scheduled-task, service, startup, and execution artefacts
• Analyse volatile memory with Volatility 3 to locate processes, injected code, network connections, and credential artefacts
• Inspect PCAP evidence in Wireshark to identify command-and-control traffic, lateral movement, and data exfiltration indicators
• Perform static malware triage in Ghidra to extract imports, strings, functions, embedded configuration, and indicators
• Conduct controlled behavioural malware analysis and map observed actions to MITRE ATT&CK techniques
• Produce a defensible forensic report containing findings, timelines, IOCs, limitations, and containment recommendations

Benefits of attending

Target competencies

Who should attend

• Digital Forensic Analysts — who must turn endpoint and memory evidence into defensible investigation findings
• Incident Response Analysts — who need to scope active compromises and prioritise containment from host artefacts
• SOC Analysts — who investigate escalated alerts and need to validate malicious activity beyond SIEM telemetry
• Malware Analysts — who require stronger host-forensic context for understanding payload behaviour and impact
• Threat Hunters — who need to convert malware and intrusion evidence into hunt hypotheses and detection content
• Cyber Security Consultants — who investigate client incidents and must present technically substantiated conclusions

Requirements and prerequisites

Participants should be comfortable working with Windows administration concepts, including processes, services, registry keys, file permissions, event logs, IP networking, DNS, HTTP, and common command-line operations. Prior experience investigating security alerts, reviewing logs, using a SIEM, or handling endpoint incidents is strongly recommended. Familiarity with basic Python or PowerShell is helpful when interpreting scripts and indicators, but participants will not be required to write malware or develop software. This is not an entry-level cyber security course: it assumes participants already understand incident-response phases, common attack techniques, and core networking terminology. No prior reverse-engineering or formal digital-forensics certification is required.

Training methodology

The instructor leads short technical briefings before participants apply each method to a linked compromise scenario. Guided labs use prepared forensic images, RAM captures, packet captures, email artefacts, and benignly contained malware samples; participants work in isolated virtual machines and document every investigative decision. Group reviews compare hypotheses, validate timelines, and challenge evidential gaps rather than simply revealing answers. Daily debriefs connect technical findings to containment choices. On day five, participants consolidate their work into a case report and action plan for applying the workflow, templates, and escalation criteria in their own environment.

Course outline

Day 1: Forensic Foundations and Windows Evidence

• Incident scoping, legal boundaries, and forensic readiness requirements
• Chain of custody, cryptographic hashing, and evidence integrity verification
• Forensic image structure and partition examination with Autopsy
• NTFS artefacts including MFT records, $UsnJrnl, and $LogFile
• Windows event-log sources for authentication, process, and service activity
• Registry artefacts including UserAssist, Shimcache, Amcache, and MUICache
• Execution evidence from Prefetch, LNK files, Jump Lists, and SRUM

Workshop: Examine a supplied workstation image in Autopsy and produce an evidence log plus an initial timeline of suspicious user and process activity.

Day 2: Host Triage, Timelines, and Persistence

• Super-timeline construction and timestamp interpretation
• MACB timestamps, timestomping indicators, and timestamp reliability
• Windows persistence through Run keys, services, scheduled tasks, and WMI
• Browser history, downloads, cache, and email attachment artefacts
• PowerShell, Windows Script Host, and command-shell execution traces
• User-profile analysis and attribution limits in shared environments
• IOC extraction, normalisation, and confidence scoring

Workshop: Build a correlated attacker timeline from host artefacts and identify the initial-access path, persistence mechanism, and affected user accounts.

Day 3: Memory and Network Forensics

• Volatile evidence priorities and memory acquisition considerations
• Volatility 3 workflow for image identification and plugin selection
• Process trees, parent-child anomalies, and hidden-process investigation
• DLL inspection, injected code indicators, and suspicious memory regions
• Network sockets, DNS cache, command history, and credential artefacts
• Wireshark display filters and protocol-stream reconstruction
• Command-and-control, beaconing, lateral movement, and exfiltration patterns

Workshop: Analyse a memory capture and companion PCAP to identify an injected process, its command-and-control endpoint, and the sequence of network activity.

Day 4: Static and Behavioural Malware Analysis

• Safe malware-handling procedures and isolated analysis-lab design
• PE file structure, hashes, entropy, packers, and compiler artefacts
• Static triage using strings, imports, exports, and resource inspection
• Ghidra navigation, function identification, cross-references, and decompilation
• Malware configuration extraction and hard-coded indicator discovery
• Controlled behavioural analysis using process, file, registry, and network observations
• MITRE ATT&CK mapping and anti-analysis technique recognition

Workshop: Triage a contained malware sample in Ghidra and a sandboxed lab, then produce an IOC sheet and ATT&CK-mapped behaviour summary.

Day 5: Case Integration and Defensible Reporting

• Integrating disk, memory, network, and malware findings
• Hypothesis testing, corroboration, and handling conflicting evidence
• Scoping affected assets, accounts, persistence, and data exposure
• Containment and eradication recommendations linked to verified findings
• Forensic report structure for technical, legal, and executive audiences
• Communicating uncertainty, limitations, and evidential confidence
• Detection engineering handover using IOCs, behavioural indicators, and hunt leads

Workshop: Complete the end-to-end compromise case file and present a technical timeline, malware assessment, containment plan, and executive summary to a mock incident board.

Tools & standards covered

Autopsy, Volatility 3, Wireshark, Ghidra

A typical training day

Live online deliveries follow the same structure in the East Africa Time zone, with shorter screen blocks and longer breaks.

What the fee includes

How you can take this course

Certification

Participants who complete the full five days receive the Skillset Development Certificate of Completion, stating the course title, course code, dates and delivery format — suitable for professional-development records and employer reimbursement.

Frequently asked questions