Home / Resources / Guide for self-study

Learn DFIR on your own, around a job

Two study paths from First Look to a capstone, the free tools each week needs, and a cadence of about three hours a week: two 90-minute sessions. Every run generates fresh evidence, so you can redo a case and still have to work it.

Path 1: Windows forensics

Windows Forensics (GCFE). 10 cases, about 18 hours, 7 weeks at this pace. 5 cases run free and the trial opens 2 more. Full notes are on the pathway page.

Free runs on download with no key. Trial opens with the 30-day trial key. Paid plan needs a license; a plan name such as Department means that plan or above.

Week	Cases	Tools that week
1	First Look: What Ran on This Machine First Look Free 33 min First Look: Recent Files and Jump Lists First Look Free 33 min First Look: USB Device History First Look Free 33 min First Look: What Runs at Startup First Look Free 33 min First Look: Building a Timeline First Look Free 37 min	DB Browser for SQLite, EvtxECmd, JLECmd, LECmd, PECmd, RegRipper, Registry Explorer, Timesketch
2	Insider Data Theft via USB Medium Trial 1 h 50 min	Autopsy, EvtxECmd, FTK Imager, JLECmd, LECmd, PECmd, Registry Explorer
3	The Customer Export Medium Paid plan 1 h 20 min The Vanished Tokens Hard Paid plan 1 h 30 min	Browser History Viewer, DB Browser for SQLite, Hindsight, LECmd, Registry Explorer, Thunderbird
4	Credential Theft and Lateral Movement Hard Trial 2 h 4 min	Event Viewer, EvtxECmd, Registry Explorer, Volatility, Wireshark
5 to 7	Espionage Intrusion Expert Department 8 h 24 min	Autopsy, EvtxECmd, PECmd, Registry Explorer, Thunderbird, Volatility, jq

Path 2: incident response

Incident Handling (GCIH). 10 cases, about 13 hours, 7 weeks at this pace. 3 cases run free and the trial opens 1 more. See the pathway page.

Week	Cases	Tools that week
1	First Look: Reading an EDR Alert First Look Free 33 min First Look: Reading a SIEM Alert First Look Free 33 min First Look: Phishing Triage First Look Free 33 min Phishing to Foothold Medium Trial 1 h	Any JSON viewer, Excel, Thunderbird, jq, text editor
2	Web Shell on a Small Business Server Medium Paid plan 1 h 45 min	Autopsy, EvtxECmd, PECmd, Registry Explorer, Volatility
3	Lateral Move to the File Server Medium Paid plan 1 h 16 min	Event Viewer, EvtxECmd, PECmd, Registry Explorer
4	Ransomware Precursor: Caught Mid-Setup Hard Paid plan 2 h 14 min	Autopsy, EvtxECmd, PECmd, Registry Explorer, Volatility
5	Ransomware Before Coffee Hard Paid plan 1 h 15 min Drill: Ransomware, 45 Minutes Hard Paid plan 45 min	Any JSON viewer, Event Viewer, EvtxECmd, Excel, Timeline Explorer, jq
6 to 7	Operation Nightfall Expert Department 3 h 14 min	Any JSON viewer, Event Viewer, EvtxECmd, Excel, Timeline Explorer, jq

Tools to install, and why

All free. Install what the week needs; the toolkit page has a one-run installer for Windows and Linux.

Windows artifacts

Eric Zimmerman's tools (PECmd, LECmd, JLECmd, EvtxECmd, Timeline Explorer) parse Prefetch, LNK files, jump lists, event logs and timelines. Registry Explorer reads hives: USB history, UserAssist, Run keys.

Disk and memory

Autopsy opens disk images and recovers deleted files. Volatility 3 lists processes, network connections and injected code in a memory image.

Browser, mail and databases

DB Browser for SQLite opens browser history and app databases. Thunderbird reads mailboxes and loose .eml files, headers included.

IR feeds

EDR and SIEM evidence ships as JSON. jq or any JSON viewer filters it; Excel or LibreOffice sorts an alert queue. Wireshark handles packet captures.

When you're stuck

Guided mode

On the Solution screen, guided mode steps through one question at a time: where to look, then how to work it with the right tool, then the answer. The printable guided worksheet adds a hint under each question and a tool quick-start.

Redo it cold

Generate the same case again with a new seed. Names, hashes, IPs and timestamps change, so the second run tests the method, not your memory of the answers.

Start with the free cases.

First Look runs free on download. The trial key adds a medium and a hard case in each path for 30 days.

Learn for free Browse the cases