Write a module.
Put your name on it.
Pick one objective from a track you know cold. A module is two to four hours of a student's time: a lab on SIFT, the reading to support it, and practice questions.
Authors who stay on ship about two modules a month. Material is kept current: a module that goes stale gets revised or retired, with you.
Contributor compensation and publishing terms will be agreed directly before work begins. This page is not an offer of payment.
Your material. Your name. Verified by hand.
- Bring your own material. Nothing lifted from any other course or vendor.
- Every command in your lab runs on SIFT, by you, before it ships. You sign the human record.
- If AI helped, say what it did and which model. Readers see it.
- State what the learner will practice and the deliverable they will build.
- Authors bring no material from any other training provider.
- Each module is written as a case, not a topic list; see the path pages for the format.
Apply to write a module
Choose a path and module below. Applications express interest; they do not reserve a module or assign authorship.
Modules open to claim
26 modules currently have no named author. The deliverables below come directly from the two launch-path curricula.
Windows Forensic Examiner · Module 00
The first hour of a case
Lab: Hash and mount a provided image read-only; start a case log
You build: An intake memo: questions, scope, legal holds, what to preserve and in what order
Windows Forensic Examiner · Module 01
Acquire without changing anything
Lab: Image a provided virtual disk, verify E01 against source, mount with shadow copies visible
You build: A documented acquisition record with hashes, tool versions and a chain-of-custody log
Windows Forensic Examiner · Module 02
Who is this user, on this machine
Lab: Profile the Matter A image from registry hives and user folders
You build: A system and user profile: OS build, time zone, accounts, SIDs, last logons, installed software
Windows Forensic Examiner · Module 03
What did they run, and when
Lab: Prefetch, Amcache, Shimcache, UserAssist, BAM and SRUM evidence on the Matter A image
You build: An execution timeline with confidence levels per artifact
Windows Forensic Examiner · Module 04
What did they open, and where did it go
Lab: LNK files, jump lists, shellbags, Office MRU and recent folders on the Matter A image
You build: A file-interaction report: opened, created, moved, deleted, with the artifact that proves each
Windows Forensic Examiner · Module 05
The device in the parking lot
Lab: Registry device keys, setupapi logs, mounted-device evidence, matching the USB image's volume serial
You build: A device history connecting serial numbers, volume names, first and last connection, and the user session
Windows Forensic Examiner · Module 06
Sync, share, delete
Lab: Cloud-sync client databases and logs on the Matter A image; browser traces of web uploads
You build: A cloud-storage findings sheet: what synced, when, what was deleted locally and what the sync database still records
Windows Forensic Examiner · Module 07
The browser tells it
Lab: Chromium and Firefox profile parsing, SQLite recovery, private-mode limits on the Matter B image
You build: A browser activity report for two users across two browsers, with session, download and cache evidence
Windows Forensic Examiner · Module 08
Mail as evidence
Lab: OST and PST parsing, webmail cache traces, header reconstruction from the mailbox exports
You build: An email analysis memo: header path, client artifacts, server-side record, what can and cannot be proven
Windows Forensic Examiner · Module 09
The contested logon
Lab: Security, System and RDP logs on the Matter D image; detecting a cleared log
You build: A logon reconstruction with event IDs, logon types, source addresses and the account's session map
Windows Forensic Examiner · Module 10
Deleted, recovered, proven
Lab: MFT, USN journal and LogFile evidence for examiners; recovering deleted files; timestamp pitfalls
You build: A recovery report showing what existed, when it was removed, and which account did it
Windows Forensic Examiner · Module 11
Triage at speed
Lab: Targeted collection, batch parsing with SIFT tools, building a combined timeline
You build: A triage collection plan and an artifact-first timeline across several hosts
Windows Forensic Examiner · Module 12
Write it so it survives cross-examination
Lab: Assemble the report from the earlier labs; a second learner reviews it against a checklist
You build: The full Matter A examination report: findings, exhibits, timeline table, limitations, peer-review log
Incident Response and Threat Hunting · Module 00
The alert at 06:10
Lab: Confirm the beacon in the proxy and DNS logs; open the case log; hold the reimage
You build: A first-hour plan: what to preserve in what order, who to notify, the five questions the investigation must answer
Incident Response and Threat Hunting · Module 01
Baseline the host before you judge it
Lab: Compare live-response output from a clean Ashgrove workstation against the alerting one; mark the one real outlier
You build: A normal-Windows reference: expected parents, paths, accounts, instance counts, and the tests that separate odd from malicious
Incident Response and Threat Hunting · Module 02
Capture memory before it is gone
Lab: Acquire memory from a lab VM, verify it, run a targeted disk collection, document the chain
You build: An acquisition record: memory first, then triage disk, hashes, tool versions, and what was lost by waiting
Incident Response and Threat Hunting · Module 03
Read the memory image: what is running
Lab: Processes, parents, command lines, handles, loaded DLLs and network connections from the claims workstation image
You build: A process tree and connection map with the beaconing process identified and its parent explained
Incident Response and Threat Hunting · Module 04
Read the memory image: what is hiding
Lab: Detect injected and hollowed regions, dump them, pull strings and indicators, scan with YARA, build the indicator list
You build: A malicious-code report: injection technique, affected process, dumped payload with hash, extracted indicators
Incident Response and Threat Hunting · Module 05
Scope the enterprise fast
Lab: Sweep the 40-host telemetry set; trace lateral movement through logon events, remote-execution artifacts and admin-share use
You build: A scoping plan and a results table: which hosts carry the indicators, which accounts were used, where the attacker went next
Incident Response and Threat Hunting · Module 06
Build the first timeline
Lab: Create and filter a file-system timeline from the MFT and related metadata; find the dropped files around the beacon time
You build: A file-system timeline of the claims workstation with the initial-access window bracketed
Incident Response and Threat Hunting · Module 07
The super timeline, and how to read it
Lab: Build a super timeline with plaso; pivot on the initial-access window; narrate the first hour of the intrusion
You build: A combined timeline (file system, registry, event logs, browser, prefetch) and a filtering method that gets a million rows down to a hundred
Incident Response and Threat Hunting · Module 08
NTFS under the hood
Lab: Parse the file server MFT and journals; prove timestomping; recover the deleted stager and its metadata
You build: An NTFS findings memo: MFT attributes, the two timestamp sets, USN journal, $LogFile, alternate data streams, and what the anomaly proves
Incident Response and Threat Hunting · Module 09
Execution, persistence and the account behind it
Lab: Registry, event logs, prefetch, Amcache, Shimcache and scheduled-task artifacts across the three disk images
You build: A persistence and execution report: scheduled tasks, services, run keys, WMI subscriptions, each with the account and time that created it
Incident Response and Threat Hunting · Module 10
Anti-forensics and what survives
Lab: Recover evidence from the USN journal, $LogFile, shadow copies, prefetch and SRUM after log clearing and deletion
You build: A recovery report: what was deleted, when, and the artifact that proves each item
Incident Response and Threat Hunting · Module 11
Hunt the next host
Lab: Baseline-versus-outlier hunting across the 40-host telemetry and the remaining memory images; find the fourth host
You build: A hunt plan with hypotheses drawn from the intrusion's known behavior, and a results sheet
Incident Response and Threat Hunting · Module 12
Tell the intrusion story
Lab: Assemble from earlier labs; peer review against a checklist; deliver the briefing to a second learner playing the general counsel
You build: The full intrusion report (summary, timeline, techniques, systems and data affected, containment, lessons) and a ten-minute briefing
Last reviewed