Incident Response and Digital Forensics
Contain, investigate and recover — with evidence that holds up.
Taught by Nisha Poudel · SOC Lead
What you'll learn
- Run the incident response lifecycle from preparation through lessons learned
- Build and follow incident playbooks for common attack types
- Preserve digital evidence and maintain a defensible chain of custody
- Capture and examine memory and disk artefacts at a foundational level
- Reconstruct an incident timeline from multiple evidence sources
- Lead a post-incident review that produces concrete improvements
About this course
When an organisation is breached, the incident response team decides how bad it gets. This course teaches you to respond to security incidents calmly and methodically, and to gather digital evidence that stands up to scrutiny. It is for SOC analysts, IT staff, and aspiring responders who want practical skills for the ransomware era. You will learn the incident response lifecycle, how to build and run playbooks, the basics of memory and disk forensics, and how to maintain chain of custody so evidence remains trustworthy. You will build timelines that explain what happened, coordinate containment and recovery, and run a post-incident review that makes the organisation stronger. By the end you can take an incident from first alert through containment, investigation, and a clear final report.
Course content
7 lessons- 1The Incident Response LifecycleThe phases of a response and why preparation decides how well the rest goes.Preview
- 2Detection, Triage, and Declaring an IncidentTurn an alert into a confirmed incident and set the response in motion.
- 3Containment, Eradication, and RecoveryStop the spread, remove the threat, and restore operations without destroying evidence.
- 4Digital Evidence and Chain of CustodyPreserve evidence so it stays trustworthy and admissible from collection to report.
- 5Memory and Disk Forensics BasicsCapture and examine volatile memory and disk artefacts to understand what happened.
- 6Building the Incident TimelineCombine evidence from every source into one clear account of what happened and when.
- 7The Post-Incident ReviewRun a blameless review that turns a painful incident into lasting improvement.