Investigations & Digital Trust · Internship Role

DIGITAL FORENSICS

Assist with evidence recovery and incident response through disk, memory and log forensics, with a chain of custody that holds up.

SKILLS YOU'LL WALK AWAY WITH

Disk & memory forensicsTimeline analysisAutopsy & VolatilityChain of custodyIR reporting

PROOF-OF-WORK TASKS

8 TASKS

Start at Beginner and work up. Every task produces something real you can show: a report, a tool, a guide or a demo. Publish it on LinkedIn or GitHub as your proof of work.

Beginner

LEVEL 01

01Write an explainer of the forensic process (identify, preserve, analyse, report) and chain of custody, with a sample chain-of-custody form.
02Use Autopsy on a NIST CFReDS practice image and find 5 artefacts (deleted files, browser history, USB connections), documenting each one.
03Hash files with SHA-256 before and after copying to demonstrate integrity verification, and explain why it matters in court.

Intermediate

LEVEL 02

01Solve 2 CyberDefenders DFIR challenges and publish write-ups that include your timeline of attacker activity.
02Analyse a memory image with Volatility 3: list processes, network connections and suspicious injected code, then write a findings summary.
03Build a super-timeline of a Windows image using Eric Zimmerman's tools, and identify the initial access point.

Advanced

LEVEL 03

01Write a full incident response report for a simulated ransomware case: scope, timeline, root cause, IOCs, containment, and lessons learned.
02Create an IR playbook for a small company covering the first 24 hours of a breach: roles, evidence collection steps, and communication templates.

HAND-PICKED FREE RESOURCES

7 RESOURCES

FREE COURSE