Sana Ullah Khan
English

Roadmaps Security roadmaps Core domains

Digital Forensics and Incident Response (DFIR)

When an attack happens, work out exactly what the attacker did, stop them, recover, and preserve the evidence properly.

Estimated time: 25–43 months · At about 10 hours a week.

  1. BeginnerEvidence, artefacts and the incident lifecycle3–4 months
  2. IntermediateMemory, network and endpoint investigations4–6 months
  3. AdvancedEnterprise, cloud and malware analysis6–9 months
  4. ExpertLeading major incidents and advancing the field12–24 months

Overview

Incident response is the process of handling a security incident: preparing for it, detecting and analysing it, containing it, removing the attacker, recovering, and learning from it. Digital forensics is the careful collection and analysis of evidence from computers, phones, memory, networks and cloud services.

Together they answer the questions every organisation asks after a breach: how did they get in, what did they touch, what did they take, are they still here, and what do we have to report? Forensic work done carefully can also stand up in court.

Why it matters

Every serious incident needs DFIR skills, and regulations such as GDPR and NIS2 set short deadlines to report incidents and their impact. A good investigation is the difference between guessing and knowing what happened.

Typical job roles

  • EntryJunior incident responder / DFIR analyst Collects evidence, runs triage tools and builds timelines under supervision.
  • Mid-levelIncident responder Investigates incidents, scopes the compromise and leads containment.
  • Mid-levelDigital forensic examiner Analyses disks, phones and memory, often for legal or HR cases.
  • SeniorMalware analyst Reverse engineers malicious code to find what it does and how to detect it.
  • SeniorSenior incident response consultant Leads response for clients, often during ransomware attacks.
  • LeadDFIR lead / head of incident response Runs the IR team, retainer clients and major incident command.

Prerequisites

  • Solid Windows and Linux knowledge, including the file system, the registry and services.
  • Networking basics and the ability to read a packet capture.
  • Security Operations beginner stage, or equivalent experience triaging alerts.
  • Scripting in Python or PowerShell for parsing and automating.

Foundations of computer science Cybersecurity

Learning path

  1. Beginner Evidence, artefacts and the incident lifecycle 3–4 months

    Topics

    • Incident response lifecycle (NIST SP 800-61)
    • Order of volatility
    • Chain of custody
    • Disk images and hashing
    • Windows artefacts (registry, event logs, prefetch, LNK)
    • Linux artefacts (logs, shell history, cron)
    • Timeline analysis
    • Report writing

    Skills

    • Take a forensic image of a disk and verify it with a hash.
    • Find evidence of program execution, logons and file access on Windows.
    • Build a simple timeline from several artefacts.
    • Keep notes and a chain of custody that someone else can follow.

    Hands-on projects and labs

    • Create a disk image of a test VM with FTK Imager or dd, then analyse it in Autopsy.
    • Use Eric Zimmerman's tools to parse the registry, prefetch and event logs from a Windows VM you used for a day.
    • Solve beginner forensics challenges on CyberDefenders using the free NIST CFReDS datasets as extra practice.

    Done when you can…

    • Explain the six phases of incident response and what happens in each.
    • Show, from artefacts alone, which programs ran on a machine and when.
    • Write a short forensic report with findings, evidence and method.
  2. Intermediate Memory, network and endpoint investigations 4–6 months

    Topics

    • Memory forensics
    • Live response and triage collection
    • Network forensics
    • Email and phishing investigations
    • Super timelines (Plaso)
    • Event log hunting (Sigma, Chainsaw, Hayabusa)
    • Containment and eradication
    • Ransomware incident handling

    Skills

    • Capture and analyse memory with Volatility 3 to find malicious processes and injected code.
    • Collect triage data from many machines with Velociraptor.
    • Scope an incident: every machine and account the attacker touched.
    • Plan containment that does not tip off the attacker too early.

    Hands-on projects and labs

    • Infect an isolated VM with a known sample from a malware training set (never on your real network), capture memory, and find the malware with Volatility 3.
    • Deploy Velociraptor to a few lab machines and hunt for a persistence technique across all of them.
    • Investigate a full scenario on CyberDefenders or Blue Team Labs Online and write it up as a client report.

    Done when you can…

    • Find an attacker's process, network connections and persistence in a memory image.
    • Lead a lab investigation from first alert to scoped compromise and a timeline.
    • Write an executive summary that a non-technical manager understands.
  3. Advanced Enterprise, cloud and malware analysis 6–9 months

    Topics

    • Enterprise-wide incident response
    • Active Directory compromise recovery
    • Cloud forensics (AWS, Azure, Microsoft 365)
    • Malware analysis (static and dynamic)
    • Reverse engineering basics
    • YARA rules
    • Mobile forensics basics
    • Threat intelligence from incidents

    Skills

    • Investigate incidents across hundreds of machines and cloud tenants.
    • Analyse a malware sample in a safe lab and write YARA rules for it.
    • Investigate a compromised Microsoft 365 or AWS account from its audit logs.
    • Turn investigation findings into detections and intelligence.

    Hands-on projects and labs

    • Set up REMnux and FLARE VM in an isolated network and analyse samples from a reputable training source.
    • Use Ghidra to reverse engineer a crackme or a training sample and describe its behaviour.
    • Simulate a compromised cloud account in your own tenant and investigate it from the logs alone.

    Done when you can…

    • Write a malware analysis report with indicators, behaviour and detection rules.
    • Run a complete simulated ransomware response, including recovery decisions.
  4. Expert Leading major incidents and advancing the field 12–24 months

    Topics

    • Major incident command
    • Legal, regulatory and insurance aspects
    • Expert witness work
    • Building an IR programme and retainers
    • Tool and method research
    • AI-assisted analysis

    Skills

    • Command a major incident with executives, lawyers, insurers and regulators involved.
    • Build an IR plan, playbooks and a team that improves after every incident.
    • Develop new forensic methods or tools, and validate them.

    Hands-on projects and labs

    • Write and run a full tabletop exercise for executives, including regulatory reporting deadlines under GDPR and NIS2.
    • Publish a tool, a parser or research on a new artefact.

    Done when you can…

    • Lead a major incident from first call to final report.
    • Have your methods or tools used by others in the DFIR community.

Tools and technologies

  • Autopsy and The Sleuth Kit Open source Open-source disk forensics platform and libraries.
  • Volatility 3 Open source The standard framework for memory forensics.
  • Velociraptor Open source Endpoint collection and hunting at scale.
  • Eric Zimmerman's tools Free Parsers for Windows artefacts: registry, event logs, prefetch, LNK and more.
  • Plaso (log2timeline) Open source Builds super timelines from many artefacts.
  • Timesketch Open source Collaborative timeline analysis.
  • Chainsaw Open source Fast hunting through Windows event logs with Sigma rules.
  • Hayabusa Open source Windows event log timeline and threat hunting tool.
  • FTK Imager Free Free disk and memory imaging tool.
  • YARA Open source Pattern matching to identify and classify malware.
  • Ghidra Open source Reverse engineering suite from the NSA.
  • REMnux Open source Linux toolkit for malware analysis.
  • SIFT Workstation Free Free forensic workstation from SANS.
  • CyberChef Open source Decode and transform data found during investigations.

Certifications

Take them in roughly this order. Costs and details for the ones marked with a link are on the Certifications page.

  1. Entry Security+ CompTIAA common baseline.Cost and exam details
  2. Intermediate Certified Defensive Security Analyst (CDSA) Hack The BoxHands-on, includes forensics and incident response.Cost and exam details
  3. Advanced GIAC Certified Incident Handler (GCIH) GIAC (SANS)The best-known incident handling certification.Cost and exam details
  4. Intermediate GIAC Certified Forensic Examiner (GCFE) GIACWindows forensics.
  5. Advanced GIAC Certified Forensic Analyst (GCFA) GIACAdvanced incident response and memory forensics.
  6. Advanced GIAC Network Forensic Analyst (GNFA) GIACNetwork forensics.
  7. Advanced GIAC Reverse Engineering Malware (GREM) GIACMalware analysis.

Resources

Frameworks and standards

  • NIST SP 800-61 Rev. 3 Incident response recommendations, aligned with CSF 2.0.
  • NIST SP 800-86 How to build forensic techniques into incident response: collection, examination, analysis and reporting.
  • ISO/IEC 27037 Guidelines for identifying, collecting, acquiring and preserving digital evidence.
  • MITRE ATT&CK A knowledge base of real attacker tactics and techniques, used to plan detections, hunts and red team work.
  • NIST Cybersecurity Framework (CSF) 2.0 A common way to describe and improve an organisation's security, organised as Govern, Identify, Protect, Detect, Respond and Recover.
  • GDPR (General Data Protection Regulation) The EU law on personal data: lawful use, people's rights, breach notification and security of processing.
  • NIS2 Directive The EU law that sets security and incident reporting duties for essential and important organisations.

All frameworks and standards

Career path

A common progression. Titles vary between companies.

  1. SOC analyst or IT administrator0–2 years
  2. Junior DFIR analyst1–3 years
  3. Incident responder or forensic examiner3–6 years
  4. Senior IR consultant or malware analyst6–9 years
  5. Head of incident response10+ years

Related domains to move into

  • Security Operations (SecOps) Detection and response go hand in hand.
  • Cloud Security More and more incidents start in cloud and SaaS accounts.
  • Malware Analysis Coming soon Go deep into how malicious code works.
  • Threat Intelligence Coming soon Turn what you learn in incidents into intelligence for others.
  • Ransomware Defense Coming soon Prepare organisations for the most common major incident.
  • AI-Assisted Digital Forensics and Threat Intelligence Coming soon Use AI to speed up investigations, and check its work.

All security roadmaps Back to top

Last reviewed: . Found a mistake, or want a roadmap written sooner? Contact