Back to Learning Paths
DFIR

Digital Forensics and Incident Response

Establish an incident-response workflow and investigate evidence across desktop, mobile, browser, removable-media, and malware sources.

FamilyDefensive Security Operations
LevelFoundational to intermediate
Courses11
Estimated time2.75-3.7 hours
Audience

Incident responders, Forensic analysts, Blue team practitioners

Outcome

Establish an incident-response workflow and investigate evidence across desktop, mobile, browser, removable-media, and malware sources.

Ordered sequence

Courses in this path

11 courses
Course 0110 modules
Introduction to Digital Forensics and Incident Response

Launch the canonical Truth Surge open course for this step in the path.

Launch Course
Course 0210 modules
What Is Incident Response Lifecycle

Launch the canonical Truth Surge open course for this step in the path.

Launch Course
Course 0310 modules
Building A DFIR Toolkit

Launch the canonical Truth Surge open course for this step in the path.

Launch Course
Course 0410 modules
Windows Forensics Fundamentals

Launch the canonical Truth Surge open course for this step in the path.

Launch Course
Course 0510 modules
Linux Forensics Fundamentals

Launch the canonical Truth Surge open course for this step in the path.

Launch Course
Course 0610 modules
macOS Forensics Fundamentals

Launch the canonical Truth Surge open course for this step in the path.

Launch Course
Course 0710 modules
Android Forensics Fundamentals

Launch the canonical Truth Surge open course for this step in the path.

Launch Course
Course 0810 modules
iPhone Forensics Fundamentals

Launch the canonical Truth Surge open course for this step in the path.

Launch Course
Course 0910 modules
Browser Forensics Fundamentals

Launch the canonical Truth Surge open course for this step in the path.

Launch Course
Course 1010 modules
USB and Removable Media Analysis

Launch the canonical Truth Surge open course for this step in the path.

Launch Course
Course 1110 modules
Static Malware Analysis Fundamentals

Launch the canonical Truth Surge open course for this step in the path.

Launch Course
Related routes
Next steps
Defensive Security Operations
Detection Engineer and Threat Hunter

Move from telemetry and adversary models into detection development, exposure prioritization, and proactive hunting.

View Path
Defensive Security Operations
Cloud Security Operations

Operate cloud defenses across identity, containers, exposure management, resilience, and incident response.

View Path
Defensive Security Operations
OSINT Foundations

Develop a disciplined public-information investigation workflow from digital-footprint concepts through technical collection and verification.

View Path