Training for
evidence work.
An investigation does not stop at one artifact. Learn through focused modules that connect the system, the evidence and the finding. Every lesson centers on work a practitioner can reproduce and explain.
By Rob T. Lee, creator of SIFT.
Start on Skool.
Build what comes next.
We are launching on Skool to get the training into your hands without waiting for custom software.
Skool brings course content and community into one place. Open Classroom for released modules. Use Community to ask questions about the evidence you are working.
You will need a Skool account. Course access depends on module releases and your membership. Lessons and community run on Skool; here is how that works.
The DFIR.com Skool group opens with the first modules.
From outline
to accountable work.
A practitioner defines the outline, the case and the learning goals.
AI may help create lecture material, labs and assessment items.
The practitioner reviews the content and runs every lab on SIFT.
The author records AI use, model version, verification and date.
The signed record is published alongside the module.
Accountability,
attached.
| Module / version | Practitioner / author | AI contribution | Model / version | Verified by hand | Sign-off / date |
|---|
Record structure only. No module has been released, so no record is signed yet. The first signed record publishes with the first module. Read the provenance standard.
Learn in modules.
Practice on evidence.
Each released module states its expected time and setup requirements before you start.
Labs run on SIFT, the free and open source forensic workstation, on your own host. Practice questions reinforce the skills used in each case.
The examiner's work
starts with the evidence.
Last reviewed