Collect, analyse and report digital evidence from files, disks, logs, network captures and memory
Put this course to work on real challenges and in-browser labs. Each CTF category is a trek through the Himalaya, climbed one stop at a time. Free to play.
When something goes wrong on a computer — a breach, a fraud, a policy violation, a mysterious crash — someone has to work out what actually happened. Digital forensics is the discipline of collecting digital evidence carefully, analysing it methodically and reporting findings that others can trust.
This course teaches the fundamentals the way investigators practise them. You will learn how to preserve evidence without changing it, identify files by their contents rather than their names, recover deleted data from disks, read Windows and Linux logs to build a timeline, analyse network captures in Wireshark, take your first look at memory forensics, and write a clear report.
Every lesson uses free, widely used tools: file, xxd, exiftool, The Sleuth Kit and Autopsy, Wireshark and Volatility. The course ends with a real investigation on the NepSec CTF Langtang Valley (Forensics) trek, written up as a forensic report.
4 sections, 9 lessons, 18m total
Incident response engineer in Kathmandu and builder of NepSec
I'm an incident response engineer at Stellar Computer Systems (SCS) in Kathmandu, where I lead incident response, analyse threats and advise clients on their security posture. My work spans security operations, threat detection, threat intelligence, security engineering and vulnerability assessment. I'm listed in Apple's Security Hall of Fame for responsibly disclosing vulnerabilities in Apple's infrastructure, and I hold certifications from Microsoft, Fortinet, Cisco, Google, CrowdStrike and The SecOps Group. When the tools I need don't exist, I build them. That's how NepSec Intel, NepSec Academy and NepSec CTF came to be. My courses teach the same practical skills I use at work, and NepSec CTF is where you put them to the test.
5 published courses
No reviews yet. Enrolled students can leave the first one.
Only free ones: the command-line basics (file, xxd, strings), exiftool, The Sleuth Kit and Autopsy, Wireshark and Volatility 3. Each lesson says where to get them.
No single course does that. This course teaches the fundamentals and good practice. Court work also needs experience, formal training and often certification.
Yes. Complete every lesson, pass the quiz and submit the investigation report to earn a certificate of completion.