Incident Response

Learning Objectives

• Execute the phases of the Incident Response lifecycle.
• Acquire forensic disk and memory images without modifying evidence.
• Analyze memory dumps for malicious processes.

Core Topics

Practical Exercise

Use Volatility to analyze a provided memory dump, extract the command history, and identify the exact command an attacker used to deploy a payload.

Recommended Learning Resources