Cyber Wiki Learning Path
Digital Forensics
Preserve and correlate storage, memory, network, endpoint, cloud, and timeline evidence to support defensible incident conclusions.
Recommended Sequence
7 connected entries
Cloud Forensics
Cloud forensics collects and analyzes provider logs, snapshots, object versions, identity records, network evidence, and service metadata for investigation.
Investigative discipline · IntermediateDigital Forensics
Digital forensics applies repeatable methods to identify, preserve, collect, examine, analyze, and communicate evidence from digital systems and services.
Digital forensics discipline · AdvancedDisk Forensics
Disk forensics acquires and examines storage media and file-system artifacts to reconstruct user, application, operating-system, and adversary activity while preserving evidence integrity and provenance.
Digital forensics method · AdvancedForensic Timeline Analysis
Forensic timeline analysis orders and correlates events from systems, files, identities, networks, applications, and people to explain what happened, when it happened, how confidently it is known, and where evidence is missing or contradictory.
Malware analysis technique · AdvancedMalware Sandboxing
Malware sandboxing executes or emulates suspicious code in a controlled environment to observe processes, files, registry changes, network activity, persistence, evasion, and other behavior without exposing production systems.
Security operations practice · IntermediateMemory Forensics
Memory Forensics is an operational security practice used to collect evidence, detect suspicious behavior, investigate events, or guide incident decisions.
Security operations practice · IntermediatePacket Capture and PCAP Analysis
Packet Capture and PCAP Analysis is an operational security practice used to collect evidence, detect suspicious behavior, investigate events, or guide incident decisions.