When an attack succeeds, two questions matter most: what did the malicious software do, and what evidence did it leave behind? Malware analysis answers the first. You'll learn static analysis, which examines a sample without running it, and dynamic analysis, which watches its behaviour in a controlled environment. You'll also get an introduction to reverse engineering with Ghidra. Always handle samples inside an isolated lab, never on a machine you care about.
Digital forensics answers the second question. You'll learn how investigators collect and preserve evidence, how forensics and incident response work together, and how to analyse memory dumps with Volatility 3 to find running processes, network connections and other traces that never reach the disk.
Once you can analyse threats and trace what happened, you'll be ready for the final module, Governance, Risk & Compliance, where you connect all of this technical work to policy, risk and the rules organisations must follow.
How to examine a suspicious file without running it, using the malware analysis lab you set up. A 24-minute lesson from LetsDefend.
The companion lesson on running a sample in a controlled environment and observing what it does to the system, from the same LetsDefend instructor.
An introduction to software reverse engineering: how programs are built, a review of x86_64 architecture, and an overview of Ghidra and its basic use. A long lecture, so use the chapters.
How digital forensics and incident response work together: the forensic process, digital evidence fundamentals, evidence collection and acquisition, Windows and Linux forensics, timelines, and reporting, with hands-on labs.
A step-by-step walkthrough of Volatility 3, from installation to listing processes, finding network connections, dumping files, and analysing the Windows Registry from a memory image.