blue · Easy · 210 XP · 30 minutes

Forensics 101

Learn about basic forensic essentials, log analysis, system volatile memory extraction, and evidence preservation tools.

Tactical attack scenario

A compromised machine was isolated from the local area network. Extract system memory, identify running malicious payloads, and trace back the intrusion point.

Learning objectives

Formulate sound evidence preservation (Chain of Custody)
Analyze Windows Event Logs (EVTX) for account hijacking
Extract volatile RAM data using volatility frameworks
Search system registry files for indicator hashes of compromised binaries

Recommended background

No prior security experience is expected; basic computer use is enough to begin.

Estimated duration: 30 minutes.

This public overview contains no flags, credentials, or solution steps. Practise only in the provided authorized environment.