Tutorvo
Menu
Courses Guides Pricing Log in Sign up
Cybersecurity Intermediate

Digital Forensics & Incident Response (DFIR)

Reconstruct an intrusion after the fact — analyse a capture, an unknown binary and a persistence artifact you create in your own lab.

8 lessons 48 min Certificate

  • One-time payment
  • 14-day money-back guarantee
  • Secure checkout with Stripe

About this course

When something is compromised, someone has to prove what happened; this course teaches how. Using safe, self-made sample artifacts in an isolated lab, you practise the investigator's workflow end to end. You learn why evidence must be collected most-volatile-first and why hashing before analysis keeps it trustworthy. Timestamp analysis turns a pile of files into a sequence of events, and the strings utility exposes the readable clues inside an unknown binary, including a beacon address. You examine a scheduled-task artifact to understand how attackers survive a reboot, then read a plaintext capture to see why unencrypted logins are a finding. Finally you correlate the pieces by their shared indicator and write a short report. Quizzes and a final exam lead to a certificate, with every artifact inert and local.

Curriculum

Course content

8 lessons · 48 min · final exam

  1. The Incident Responder’s JobReading6 min
    Unlocked when you buy the course
  2. Evidence & the Order of VolatilityReading6 min
    Unlocked when you buy the course
  3. Disk Triage & TimelinesReading6 min
    Unlocked when you buy the course
  4. Malware Triage with stringsReading6 min
    Unlocked when you buy the course
  5. Hunting PersistenceReading6 min
    Unlocked when you buy the course
  6. Network Forensics — Reading the pcapReading6 min
    Unlocked when you buy the course
  7. Correlation & the TimelineReading6 min
    Unlocked when you buy the course
  8. Final Exam — Solve Case #8842Reading6 min
    Unlocked when you buy the course
  9. Final exam8 questions, 70% to pass, unlimited retries.

Certificate

Finish with a certificate you can verify

Complete every lesson and pass the final exam to receive a certificate of completion for this course, with a unique credential ID and a public verification page.

  • Names the course, your score and the date of issue
  • A verification link for your CV or LinkedIn profile
  • 8 questions, 70% to pass, unlimited retries.

A Tutorvo certificate confirms that you completed a course. It is not an official or professional qualification.

Illustration. Your certificate shows your own name, course and credential ID.

Before you buy

Questions about this course

Is this a subscription?

No. You pay $9.99 once for this course. There is no subscription and nothing renews automatically. Prices are in US dollars; taxes may be added where required.

What exactly do I get?

All lessons and labs of this course, the final exam and the certificate, including later updates to the course, for as long as Tutorvo offers it. Access is personal and tied to your account.

Can I get a refund?

Yes. If you are not satisfied, email hello@tutorvo.com within 14 days of buying and we refund the course in full via Stripe. The guarantee does not apply once a certificate for the course has been issued to you, or where there are signs of abuse.

When can I start?

Right after payment. Access starts immediately at your request; for consumers in the EU/EEA the statutory right of withdrawal therefore ends once access has begun, while our 14-day money-back guarantee applies regardless.

Do I need Excel or other software?

No. The labs run in a spreadsheet inside your browser on a laptop, tablet or phone. Function names and syntax follow Excel.

Is the certificate an official qualification?

No. It confirms that you completed all lessons of the course and passed its final exam. It is not an official, state-recognised or professional qualification. The name is taken from your profile when the certificate is issued.

Full details are in our Terms · hello@tutorvo.com

Browse all Cybersecurity courses →
$9.99one-time payment
Buy course