Guided DFIR training lab: execution-artifact triad + intrusion hunting, with real practice data. Pairs with dfir-aio.
-
Updated
Jul 17, 2026 - Shell
Guided DFIR training lab: execution-artifact triad + intrusion hunting, with real practice data. Pairs with dfir-aio.
Rem delivery drop - files/scripts pushed for pull at work
One-liner pull of a prebuilt Windows VMware DFIR lab VM with all tools native (Volatility3, capa, FLOSS, YARA, oletools, Eric Zimmerman, Chainsaw, Hayabusa, Sleuth Kit, RegRipper, AppCompatProcessor) plus the dfir-training-lab. Educational.
Add a description, image, and links to the project-dfir topic page so that developers can more easily learn about it.
To associate your repository with the project-dfir topic, visit your repo's landing page and select "manage topics."