Search DFRTI
Disciplines, tools, courses, certifications, standards, insights, career guides, software and questions. Titles and short descriptions only, never paid lesson content.
Forensic disciplines 4
- Memory, malware and incident responseMemory ForensicsRAM holds what a computer is doing right now: the processes, connections, keys and decrypted data that never reach the disk. Memory forensics captures that moment and reads it after the fact.
- Devices and storageChip-Off and Hardware ForensicsHardware forensics reaches the memory chip directly when the device cannot be read through its normal interface. It is powerful, destructive and used only where the law and the case justify it.
- Memory, malware and incident responseDigital Incident ResponseIncident response is what an organisation does when a security breach is under way: stopping the damage, finding out what happened and getting back to work, while keeping the evidence that will be needed afterwards.
- Memory, malware and incident responseMalware ForensicsMalware forensics works out what a malicious program did on a system and how it got there, by examining the code itself and the traces it left. It is part forensic examination and part reverse engineering, done safely and under control.
Tools 3
- Exterro · Computer forensicsExterro FTK ImagerFTK Imager is the free tool most learners meet first. It makes forensic images of drives, folders and memory, verifies them with hashes and lets an examiner preview evidence before committing to a full acquisition.
- ACE Lab · Storage and hardwarePC-3000 FlashThe PC-3000 Flash reads raw NAND memory chips and rebuilds the user data that a dead or damaged controller can no longer present.
- The Volatility Foundation · Memory and malwareVolatility 3Volatility 3 reads a memory image and rebuilds what the operating system knew at the moment of capture: processes, connections, loaded modules, handles and code that never touched the disk. It replaced Volatility 2, which is now archived.
Courses 6
- Course · Incident Response & Malware AnalysisMemory ForensicsCapture RAM and use Volatility 3 to find hidden processes, injected code and connections.
- Course · Mobile & IoT ForensicsSIM / Memory Card ForensicsICCID, IMSI and SMS from SIM cards, plus FAT and exFAT recovery from SD and microSD cards
- Course trackIncident Response & Malware AnalysisMalware analysis, memory forensics and threat investigation
- Course trackMobile & IoT ForensicsAndroid, iOS, SIM cards and IoT devices
- Course · Digital Storage ForensicsUSB / Pen Drive ForensicsExamine pen drives and memory sticks and prove which USB device touched which computer.
- Course · Network & Cloud ForensicsVirtual Machine / Hypervisor ForensicsExamine VMDK, VHDX and QCOW2 disks, snapshots, ESXi logs and VM memory files.
Certifications 2
- CertificationDCMFE · Mobile Forensics ExpertThe DCMFE is for people who work on phones. It covers Android and iOS extraction, SIM and memory cards and the app data that most cases now turn on.
- CertificationMalware Analyst CertificateThis certificate is for people who need to take malware apart and respond when it hits. It covers memory forensics, reverse engineering and ransomware response.
Pages 2
- ResearchDFRTI Tools & InnovationsWe build forensic tools for storage, mobile, cloud, memory and malware work. The aim is simple: more accurate evidence, found faster, with every step on record.
- ResearchOngoing Research ProjectsOur active projects cover disk analysis, mobile evidence, cloud forensics, memory research and malware investigation. Each one starts from a problem investigators run into on real cases.
Questions 3
- FAQ · Tools and resourcesAre interactive lab simulations available?Yes. Virtual labs and simulations cover disk and storage imaging, mobile artefact extraction, memory and malware analysis, network traffic m
- FAQ · Tools and resourcesWhat kinds of forensic tools does DFRTI provide?DFRTI gives access to tools for disk and storage forensics, mobile extraction, memory analysis, network and cloud forensics, image and video
- FAQ · CoursesWhat tools and software are used in the courses?Courses use industry-standard forensic tools for disk imaging, mobile forensics, memory analysis, network packet capture and analysis, artef