Incident Response and Digital Forensics

Learn the PICERL incident response lifecycle (Preparation, Identification, Containment, Eradication, Recovery, Lessons Learned) and the specific actions that must happen in the first 15 minutes of any confirmed incident. By the end you will be able to walk Camila through the lifecycle with Beacon Harbor examples, execute the first 15 minutes correctly on a ransomware or BEC scenario, and name the specific legal + regulatory obligations that trigger within 24 hours of discovery.

Learn to extract what an attacker did on a compromised system by analyzing live memory captures with Volatility 3 — the industry-standard open-source memory forensics framework. By the end you will understand the critical artifacts in a memory image (process tree, loaded DLLs, network connections, injected code, hidden processes), know the top 10 Volatility plugins by investigative value, and recognize common attacker techniques (process injection, DLL side-loading, in-memory-only payloads) by their forensic signature.

Learn disk forensics with Autopsy (the industry-standard open-source digital forensics platform) and the key Windows artifact locations that reveal user + attacker activity. By the end you will know the top 10 forensic artifacts on a Windows disk (NTUSER.DAT, Prefetch, SRUM, Amcache, ShimCache, LNK files, browser history, event logs, scheduled tasks, Volume Shadow Copies), understand Autopsy's workflow, and be able to recover deleted files + timeline user activity.

Learn how to reconstruct an attack timeline from log fragments spread across endpoint, identity, network, and cloud control-plane sources. By the end you will know the specific log sources that provide IR evidence, understand the timeline-correlation discipline that produces a defensible attack narrative, and be able to detect log-tampering by the attacker (gaps, inconsistencies, overwritten entries).

Learn to produce the two reports every IR produces — the executive brief (what happened, business impact, what's being fixed) and the detailed after-action review (full timeline, root cause, lessons learned, control improvements). By the end you will know what belongs in each type of report, how to write for executive vs technical audiences, and what makes a post-incident process actually drive improvement vs become a document that sits in a folder.

Run a 90-minute ransomware tabletop exercise with the AI agent playing all other IR team members (CISO Camila, IT Director Jerome, SOC Manager Priya, Legal Counsel Dale). You play the IR Commander. Walk through the first 90 minutes of a live ransomware event, make the real decisions (preserve or wipe, pay or not, disclose when), and receive feedback on each decision.