The best way to make the modules stick is to investigate something yourself. These five projects take you through disk analysis with Autopsy, Linux memory acquisition with LiME, memory analysis with Volatility, malware traffic analysis in Wireshark, and finally incident response with Redline.
Each one is a hands-on walkthrough, so you can pause, follow along in your own lab and apply the same steps to practice evidence. Pick the project that matches the module you've just finished and come back for the rest. Always work on practice images and captures in an isolated virtual machine.
Open a practice disk image, create a new case in Autopsy, and work through data sources, artifacts, tags, and the timeline, with FTK Imager covered along the way.
Build the LiME kernel module and use it to dump the memory of a Linux machine, then locate the RAM dump file for analysis.
Use the Volatility framework on a memory image in a blue team scenario to look for signs of malicious activity.
Work through a Wireshark workshop on spotting Windows malware infections in real packet captures, from the Unit 42 team.
Collect data with FireEye Redline and open an analysis session to find signs of malicious activity through memory and file analysis.