Digital Forensics

Investigate what happened after a simulated security incident.

Evidence

preservation and investigation workflow

build an incident timeline

inspect files and metadata

analyze packet captures

explain what happened and how